🛡️ Microsoft Defender Integration

"Bring endpoint security, vulnerabilities and incidents into your GRC workspace — live from Microsoft Defender, ready to link to risks, assets and controls."
See your security posture at a glance, sort through what matters, and import Defender records as governed Brainframe documents without leaving your compliance workflow.

The Microsoft Defender integration connects Brainframe to Microsoft Defender for Endpoint and Microsoft 365 Defender through the same Microsoft Entra ID app registration you use for directory integration. Once configured, you get a live security dashboard, browsable device and threat data, and the ability to import Defender objects as Brainframe documents — with fresh data every time you open an imported record.

For CISOs and compliance professionals, this closes the gap between operational security tooling and GRC evidence: you can pull a critical CVE, an active incident, or a misconfiguration recommendation directly into a risk register, audit folder, or remediation tracker — and keep that record current as Defender updates.

1️⃣ Before You Begin

To use the integration you will need:

• 🛠 A Brainframe workspace administrator (to configure Microsoft Entra ID credentials and grant Azure permissions).
• 🔐 An existing Microsoft Entra ID integration in the same workspace — Defender reuses those credentials; no separate secret is stored for Defender.
• 🪪 Microsoft Defender for Endpoint licensing for the modules you want (see License requirements below).
• 📂 Read-only API permissions consented in Azure for both the Defender for Endpoint API and Microsoft Graph security APIs.

💡 Defender and Entra share one app registration. You add extra application permissions for Defender on the same Entra app — you do not create a second registration.

2️⃣ Configure the Integration

Microsoft Defender does not use a separate username/password screen. Configuration is about extending your existing Entra app with the right permissions and verifying that each Defender module is available.

Go to Workspace Settings → Integrations → Microsoft Defender → Configure (/integrations/microsoft-defender/config).

Step 1 — Confirm Entra credentials

The configuration page shows whether Microsoft credentials are detected (Tenant ID and Client ID from your Entra integration).

• If Entra is missing, click Configure Microsoft Entra ID credentials and complete that setup first.
• If Entra is already configured, continue to add Defender permissions in Azure.

Step 2 — Add permissions in Azure

Open your app registration in the Microsoft Entra admin center → App registrations → API permissions.

A. Defender for Endpoint API (WindowsDefenderATP)

Add Application permissions:

B. Microsoft Graph

Add Application permissions:

Then click Grant admin consent for your tenant on the API permissions page. Admin consent is required — adding permissions alone is not enough.

Step 3 — Test the connection

Back in Brainframe, click Re-test connection. The Module capability status table shows which Defender modules are available:

When credentials and at least one module are available, open Microsoft Defender from the configuration screen to start browsing.

📌 Brainframe only reads from Defender. It does not remediate endpoints, change incident status, or modify Defender configuration on your behalf.

🪪 License requirements

💡 If a tab shows a yellow missing license or not provisioned banner, other tabs may still work. Brainframe surfaces the limitation clearly rather than failing silently.

Government and sovereign clouds

Brainframe automatically detects whether your tenant uses commercial, GCC, GCC High, or DoD cloud regions and opens the correct Defender portal links (security.microsoft.com vs security.microsoft.us). No extra configuration is required beyond standard Entra setup for that cloud.

3️⃣ Using the Microsoft Defender Integration Page

Open Workspace Settings → Integrations → Microsoft Defender (or the Integrations item in the sidebar when Defender is enabled for your workspace).

The page header includes Configure (gear) and Refresh. Use Refresh after large changes in Defender or after granting new permissions in Azure.

📊 Top KPI cards (security posture at a glance)

Seven cards summarise tenant-level posture. Several are clickable — they switch to the relevant tab and apply a matching filter.

Colour cues help triage: green for healthy counts, amber/orange for attention needed, red for elevated risk.

📌 For board reporting or ISO/SOC evidence, screenshot or export these KPIs alongside imported records in your compliance folders.

4️⃣ Tabs, Filters and Tables

Five main tabs organise Defender data. Each tab has search, filters, sortable columns, pagination, an Open Defender dashboard link (context-aware for the active tab), and Import actions.

🖥 Devices

Your onboarded endpoints — the operational asset inventory security teams care about.

Filters: Risk, Exposure, Health, OS platform, RBAC group, Device value, Entra-joined (Yes/No), Internet-facing.

Key columns: Device name, OS, Health, Risk, Exposure, Device value, Last seen, First seen, IP, Entra-joined, Group, Tags.

Typical CISO use: Identify unmanaged or high-risk workstations linked to critical business assets; import key servers or privileged admin devices into an asset register.

⚠️ Vulnerabilities

CVE-level vulnerability intelligence from Defender TVM.

Filters: Severity (Critical / High / Medium / Low), Public exploit, Exploit verified, In exploit kit.

Key columns: CVE, Severity, CVSS, exploit flags, Exposed devices, Published/Updated dates, Fixing KB, Description.

Typical compliance use: Import Critical/High CVEs with public exploits into a Vulnerability document type; link to risk treatments and patch-management controls (e.g. ISO 27001 A.8, NIS2 technical measures).

🔧 Misconfigurations

Secure configuration recommendations (misconfigurations and hardening gaps).

Filters: Category, Remediation type, Status (Active / Exception), Has active alert, Has public exploit.

Key columns: Recommendation name, Category, Severity impact, Secure Score impact, Exposure impact, Exposed devices, Status, Related component.

Default view: Active recommendations only.

Typical compliance use: Track configuration drift against CIS benchmarks or internal hardening baselines; import top recommendations into a Misconfiguration register tied to control testing.

🚨 Incidents & Alerts

Two sub-views under one tab:

Filters: Severity, Status, Classification (True positive / False positive / etc.), Date range, MDE only vs All XDR sources.

Incident columns: Name, Severity, Status, Classification, Determination, Assigned to, Created, Priority score, Alert count.

Alert columns: Title, Severity, Status, Service source, Detection source, Category, MITRE techniques, Classification, Activity timestamps.

Typical compliance use: Import active incidents into an Incident folder for breach notification workflows, post-incident review, or SOC handover documentation.

✅ Remediation Tasks

Tracked remediation work items from Defender TVM (patching, configuration fixes).

Filters: Status (Active, Completed, Cancelled, Pending).

Key columns: Task title, Related recommendation, Status, Due date, Created, Target devices.

Typical compliance use: Import open remediation tasks as Action documents in a remediation programme folder; align with audit findings or penetration-test follow-ups.

5️⃣ Browse, Import and Live Documents

Browsing and opening in Defender

• Click a table row to open that record in the Microsoft Defender portal in a new tab.
• Use the ↗ Open in Defender button on a row for the same action without selecting the row.
• Open Defender dashboard (top right of the filter bar) jumps to the matching section in the Defender portal for the tab you are on.

Importing into Brainframe

Import turns a Defender record into a native Brainframe document in a folder you choose.

Default document types on import

When importing from a table view, Brainframe pre-selects that table’s document type in the import dialog.

Live data on imported documents

Unlike a one-time export, imported Defender documents stay connected to the source:

• Each time you open the document, Brainframe fetches the latest data from Microsoft Defender.
• Severity, status, exposure counts, MITRE techniques, and other fields refresh automatically.
• Use Open in Defender from the inline viewer to jump to the canonical record in the portal.

This is ideal for evidence that must stay current — e.g. a vulnerability linked to a risk treatment, or an incident referenced in a management review.

📌 Imported documents remain in your workspace if you later change Entra permissions. They simply show the most recent data Defender still allows you to read.

6️⃣ Adding Defender Records from Folders and Table Views

You do not need to open the full integration page for every import.

Folder NEW menu

1. Open any folder → NEW → Add from integrations.
2. Select Microsoft Defender from the catalog (filter by Vulnerabilities, Incidents, Assets, or Misconfigurations if helpful).
3. Browse the same tabs, filters, and KPI cards as the main integration page.
4. Import one or many records into the chosen folder.

Table view cloud button

In a document-type table, click the cloud icon (Add from integrations). The same Defender browser opens, with the current table’s document type pre-selected for import.

Typical workflows

7️⃣ Sidebar Integrations Menu

When Defender is configured and enabled in your workspace menu settings, Microsoft Defender appears under Integrations in the left sidebar.

• Greyed-out entries mean the integration is visible in menu configuration but not enabled or not accessible for your user — ask an administrator to enable it under Workspace Settings → Menu interface.

Configuration always remains under Integrations → Microsoft Defender → Configure.

8️⃣ How CISOs and Compliance Teams Typically Use Defender in Brainframe

Connect security operations to GRC

ISO 27001 / SOC 2 / NIS2 alignment (examples)

• Vulnerability management (A.8 / CC7) — Import Critical/High CVEs; link to patch SLAs and risk acceptance records.
• Secure configuration (A.8) — Import misconfiguration recommendations; map to hardening standards.
• Incident management (A.5 / CC7) — Import incidents; maintain timeline evidence for audits.
• Asset inventory (A.5) — Import representative devices; cross-reference with Entra-joined status from the Devices tab.
• Continuous monitoring — Live refresh on imported records supports “point-in-time plus ongoing” audit narratives.

Pair with Microsoft Entra ID

Many organisations use both integrations on the same app registration:

• Entra ID — identities, directory devices, conditional access, identity risk.
• Microsoft Defender — endpoint health, CVEs, incidents, remediation.

Together they give a fuller identity + endpoint picture inside Brainframe without duplicate credential management.

9️⃣ Permissions Summary

Credentials are encrypted at rest and never shown in the browser after save (via the shared Entra integration).

🔟 Troubleshooting

Related integrations

For Entra directory setup and permission details, see the Microsoft Entra ID integration guide. For application security findings, see the Aikido integration guide.

Updated on: 14/07/2026