Before You Start

You need three pieces of information from Microsoft Entra ID:

  1. Tenant ID — identifies your organisation in Entra ID
  2. Client ID — identifies the app registration you create to access the API
  3. Client Secret — the password for that app registration

Setting Up Entra ID Access

Step 1 — Register an Application

  1. Sign in to the Azure Portal
  2. Go to Microsoft Entra ID → App registrations → New registration
  3. Give it a name (e.g. Entrust-Discovery-MsDefender) and click Register
  4. Copy the Directory (tenant) ID and Application (client) ID from the Overview page

Step 2 — Create a Client Secret

  1. In your new app registration, go to Certificates & secrets → New client secret
  2. Set a description and expiry, then click Add
  3. Copy the Value immediately — it is only shown once

Step 3 — Grant API Permission

  1. Go to API permissions → Add a permission → APIs my organization uses
  2. Search for WindowsDefenderATP and select it
  3. Choose Application permissions and tick Vulnerability.Read.All
  4. Click Add permissions, then click Grant admin consent (requires an Entra ID admin)