Microsoft Defender (Client Credentials)

🚀 Quickstart

Connect to Microsoft Defender (Client Credentials) with Nango and see data flow in 2 minutes.

Create the integration

In Nango (free signup), go to Integrations -> Configure New Integration -> Microsoft Defender (Client Credentials).

Authorize Microsoft Defender for Endpoint

Go to Connections -> Add Test Connection -> Authorize, then enter your Tenant ID, Client ID, and Client Secret. Later, you’ll let your users do the same directly from your app.

Call the Microsoft Defender for Endpoint API

Let’s make your first request to the Microsoft Defender for Endpoint API to list alerts. Your app needs the Alert.Read.All application permission for this request. Replace the placeholders below with your Environment API key, integration ID, and connection ID:

cURL
Node

curl "https://api.nango.dev/proxy/api/alerts?\$top=10" \
  -H "Authorization: Bearer <NANGO-API-KEY>" \
  -H "Provider-Config-Key: <INTEGRATION-ID>" \
  -H "Connection-Id: <CONNECTION-ID>"

Install Nango’s backend SDK with npm i @nangohq/node. Then run:

import { Nango } from '@nangohq/node';

const nango = new Nango({ apiKey: '<NANGO-API-KEY>' });

const res = await nango.get({
    endpoint: '/api/alerts',
    params: { $top: '10' },
    providerConfigKey: '<INTEGRATION-ID>',
    connectionId: '<CONNECTION-ID>'
});

console.log(res.data);

Or fetch credentials with the Node SDK or API.✅ You’re connected! Check the Logs tab in Nango to inspect requests.

Implement Nango in your app

Follow our quickstart to integrate Nango in your app.

API gotchas

Integrations default to the https://api.securitycenter.microsoft.com/.default scope, which you can change in the integration’s Settings. The client credentials flow only accepts a /.default scope, and Microsoft requires this audience for the Defender for Endpoint APIs, even though requests go to https://api.security.microsoft.com.

The scope doesn’t grant individual permissions. The token includes the application permissions an admin has consented to on the app registration.

Each endpoint needs its own application permission on the WindowsDefenderATP API, such as Alert.Read.All or Machine.Read.All. A missing permission returns 403 Forbidden. Check the Permissions section of each endpoint in the API reference.

Overview

1,000+ APIs & Integrations

Microsoft Defender (Client Credentials)

🚀 Quickstart