Register and configure the Microsoft Defender in the Microsoft Azure portal

task australia Updated Sep 10, 2026 1 min read register-and-configure-the-microsoft-defender-in-the-microsoft-azure-portal.md

Raw file servicenow.com

Register the Microsoft Defender EDR in the Microsoft Azure portal and grant the read and write access to the application.

Before you begin

Role required: Application developer, Tenant administrator.

Procedure

Log in to the Microsoft Azure portal.
Enter App registrations in the Search box, and click Click New registration.
Enter a name for your application and the redirect URI, and click Register.

An example name is Microsoft Defender for Endpoint. The Redirect URI is used while providing admin consent for the application.
In the App registrations page, select the application that you registered in Step 3.
Under Manage, select Certificates & secrets.
To create a client secret, select New client secret.
Copy the client secret and save it.

In case you forgot the client secret, you can generate a new client secret.
Navigate to Manage > API Permissions.
Click Add a permission.
In the Request API permissions window, click the APIs my organization uses tab.
Search for and select WindowsDefenderATP.
In the WindowsDefenderATP permissions, select Application permissions.

Enabling this permission ensures that the application runs as a background service or daemon without a signed-in user.
Add the following application level permission and grant admin consent for the newly added API permission.

Permission Permission Display Name

Ti.ReadWrite.All Read and write Indicators

Permission	Permission Display Name
Ti.ReadWrite.All	Read and write Indicators

Parent Topic:Microsoft Defender for EDR integration

Keywords Microsoft DefenderMicrosoft Azure portalEDRregister applicationread and write access

65 lines · 2.7 KB Wrap lines

---
title: Register and configure the Microsoft Defender in the Microsoft Azure portal
description: Register the Microsoft Defender EDR in the Microsoft Azure portal and grant the read and write access to the application.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/register-and-configure-the-microsoft-defender-in-the-microsoft-azure-portal.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [Microsoft Defender, Microsoft Azure portal, EDR, register application, read and write access]
breadcrumb: [Microsoft Defender for EDR integration, TISC Security Tools integrations, TISC Integrations, Integrate, Threat Intelligence Security Center, Security Operations]
---

# Register and configure the Microsoft Defender in the Microsoft Azure portal

Register the Microsoft Defender EDR in the Microsoft Azure portal and grant the read and write access to the application.

## Before you begin

Role required: Application developer, Tenant administrator.

## Procedure

1. Log in to the Microsoft Azure portal.

2. Enter `App registrations` in the Search box, and click **Click New registration**.

3. Enter a name for your application and the redirect URI, and click **Register**.

An example name is `Microsoft Defender for Endpoint`. The Redirect URI is used while providing admin consent for the application.

4. In the **App registrations** page, select the application that you registered in Step 3.

5. Under Manage, select **Certificates &amp; secrets**.

6. To create a client secret, select **New client secret**.

7. Copy the client secret and save it.

In case you forgot the client secret, you can generate a new client secret.

8. Navigate to **Manage** &gt; **API Permissions**.

9. Click **Add a permission**.

10. In the Request API permissions window, click the **APIs my organization uses** tab.

11. Search for and select **WindowsDefenderATP**.

12. In the WindowsDefenderATP permissions, select **Application permissions**.

Enabling this permission ensures that the application runs as a background service or daemon without a signed-in user.

13. Add the following application level permission and grant admin consent for the newly added API permission.

|Permission|Permission Display Name|
|----------|-----------------------|
|Ti.ReadWrite.All|Read and write Indicators|

**Parent Topic:**[Microsoft Defender for EDR integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-ms-defender-integration.md)