> ## Documentation Index
> Fetch the complete documentation index at: https://nango.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender (Client Credentials)

> Integrate your application with the Microsoft Defender for Endpoint API using Client Credentials

## 🚀 Quickstart

Connect to Microsoft Defender (Client Credentials) with Nango and see data flow in 2 minutes.

**1. Create the integration**

In Nango ([free signup](https://app.nango.dev)), go to **Integrations** -> *Configure New Integration* -> *Microsoft Defender (Client Credentials)*.

**2. Authorize Microsoft Defender for Endpoint**

Go to **Connections** -> *Add Test Connection* -> *Authorize*, then enter your **Tenant ID**, **Client ID**, and **Client Secret**. Later, you'll let your users do the same directly from your app.

**3. Call the Microsoft Defender for Endpoint API**

Let's make your first request to the Microsoft Defender for Endpoint API to list alerts. Your app needs the `Alert.Read.All` application permission for this request. Replace the placeholders below with your [Environment API key](https://nango.dev/docs/reference/backend/http-api/api-keys.md), integration ID, and connection ID:

**cURL**

```bash theme={null}
curl "https://api.nango.dev/proxy/api/alerts?\$top=10" \
  -H "Authorization: Bearer <NANGO-API-KEY>" \
  -H "Provider-Config-Key: <INTEGRATION-ID>" \
  -H "Connection-Id: <CONNECTION-ID>"
```

**Node**

Install Nango's backend SDK with `npm i @nangohq/node`. Then run:

```typescript theme={null}
import { Nango } from '@nangohq/node';

const nango = new Nango({ apiKey: '<NANGO-API-KEY>' });

const res = await nango.get({
    endpoint: '/api/alerts',
    params: { $top: '10' },
    providerConfigKey: '<INTEGRATION-ID>',
    connectionId: '<CONNECTION-ID>'
});

console.log(res.data);
```

Or fetch credentials with the [Node SDK](https://nango.dev/docs/reference/backend/backend-sdk/node.md#get-a-connection-with-credentials) or [API](https://nango.dev/docs/reference/backend/http-api/connections/get.md).

✅ You're connected! Check the **Logs** tab in Nango to inspect requests.

**4. Implement Nango in your app**

Follow our [quickstart](https://nango.dev/docs/getting-started/quickstart.md) to integrate Nango in your app.

## 📚 Microsoft Defender (Client Credentials) integration guides

* [How do I link my account?](https://nango.dev/docs/api-integrations/microsoft-defender-cc/connect)\
  Register an app in Microsoft Entra ID and get your Tenant ID, Client ID, and Client Secret.

Official docs: [Microsoft Defender for Endpoint API](https://learn.microsoft.com/en-us/defender-endpoint/api/apis-intro)

## 🧩 Pre-built syncs & actions for Microsoft Defender (Client Credentials)

Enable them in your dashboard. Extend and customize to fit your needs.

*No pre-built syncs or actions available yet.*

> [!TIP]
>
> Not seeing the integration you need? [Build your own](https://nango.dev/docs/guides/functions/functions-guide.md) independently.

## API gotchas

* Integrations default to the `https://api.securitycenter.microsoft.com/.default` scope, which you can change in the integration's **Settings**. The client credentials flow only accepts a `/.default` scope, and Microsoft requires this audience for the Defender for Endpoint APIs, even though requests go to `https://api.security.microsoft.com`.
* The scope doesn't grant individual permissions. The token includes the application permissions an admin has consented to on the app registration.
* Each endpoint needs its own application permission on the **WindowsDefenderATP** API, such as `Alert.Read.All` or `Machine.Read.All`. A missing permission returns `403 Forbidden`. Check the **Permissions** section of each endpoint in the [API reference](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list).

***


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.