--- title: Connecting Microsoft Defender Vulnerability Management description: MDE Vulnerability Management --- [Skip to content](https://support.preludesecurity.com/connecting-microsoft-defender-vulnerability-management#main-content) English Show submenu for translations [Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en) ![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png) Open main navigation Close main navigation - English Show submenu for translations - [Contact support](https://support.preludesecurity.com/kb-tickets/new) - [Visit the website](https://www.preludesecurity.com/) [Visit the website](https://www.preludesecurity.com/) Find what you're looking for - There are no suggestions because the search field is empty. 1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en) 2. [Monitor](https://support.preludesecurity.com/monitor?hsLang=en) 3. [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations) # Connecting Microsoft Defender Vulnerability Management ### Connecting Microsoft Defender Vulnerability Management *Prelude integrates with multiple Microsoft use-cases/products. This page provides information to configure for a single user-case.  It is recommended however that you configure a single, all-in-one Microsoft App registration for all Microsoft integrations, which can be done [automatically](https://support.preludesecurity.com/microsoft-automated-integration-setup?hsLang=en) with a [single click here](https://support.preludesecurity.com/microsoft-automated-integration-setup?hsLang=en)or  following the instructions [manually here](https://support.preludesecurity.com/docs/microsoft-all?hsLang=en).  Alternatively you can continue below for use-case specific integration instructions.* ### Automated Method Navigate to the integrations page within the Monitor console.  Click Connect for the Microsoft Defender Vulnerability card. ![](https://support.preludesecurity.com/hs-fs/hubfs/undefined-Jan-14-2026-10-19-25-6667-PM.png?width=313&height=201&name=undefined-Jan-14-2026-10-19-25-6667-PM.png) Click "Configure integration with your Microsoft Entra ID" and provide credentials that have either Global Administrator or App Administrator permissions. ![](https://support.preludesecurity.com/hs-fs/hubfs/undefined-Jan-14-2026-10-20-30-9123-PM.png?width=670&height=102&name=undefined-Jan-14-2026-10-20-30-9123-PM.png) Prelude Monitor will configure the app registration automatically to complete the integration.  If you logged in with App Administrator permissions, a global administrator will need to click the Grant Admin Consent button for any new permissions.   ### Manual Method To attach a Microsoft Defender account to Detect, you will need: - The Prelude Dashboard / UI ([US1](https://platform.us1.preludesecurity.com/dashboard) | [EU1](https://platform.eu1.preludesecurity.com/dashboard)) or [Prelude CLI](https://support.preludesecurity.com/docs/prelude-cli?hsLang=en) - An Azure user with Global Administrator role #### In Azure ##### Create an App Registration 1. Navigate to the [App registrations section](https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) in the **Azure Portal**. 2. Select "**+ New registration**" toward the top of the page. 3. Enter a name for your application 4. Choose **Single tenant** as the supported account type (*Accounts in this organizational directory only*). Click Register. 5. Leave **Redirect URI (optional)** as it is. 6. After registration: 1. Copy/Save the **Application (client) ID** and **Directory (tenant) ID** from the app's **Overview page**. 7. In the left menu, expand the **Manage** section and select **Certificates & secrets** and create a **new Client Secret**: 1. Click **New client secret**, enter a description, and set an expiration period. 2. Copy/Save the generated **Client Secret Value** (you won’t be able to view it later). The following information are need to be documented/saved for later. - **APP ID** (*Application (client) ID*) from step 6 - **TENANT ID** (*Directory (tenant) ID*) from step 6 - **APP SECRET** (*Client Secret Value*) from step 7 ##### Granting API Permissions 1. In the left menu of the app you created, select **API permissions** and click **Add a permission** 2. Under "**Microsoft APIs**" select **Microsoft Graph** 1. Select Delegated permissions (not Application) and add the following API Permissions. - `User.Read` (*note: this may already be selected*) 2. Select Application permissions (not Delegated) and add the following API Permissions. - `ThreatHunting.Read.All` 1. 1. - `DeviceManagementConfiguration.Read.All` 2. Under "**APIs my organization uses**" search for: "**WindowsDefenderATP**" select "**WindowsDefenderATP**" 1. Select Application permissions (not Delegated) and add the following API Permissions. - `Machine.Read.All` 1. 1. - **Note**: After adding the above permissions ensure you select "Grant admin consent for " as show in the screenshot below:![](https://support.preludesecurity.com/hs-fs/hubfs/bb45d76b14f5e436491948793b3c9855e37e7e7c2f15cedb590452e374137827-image%20(2)-png.png?width=670&height=262&name=bb45d76b14f5e436491948793b3c9855e37e7e7c2f15cedb590452e374137827-image%20(2)-png.png) #### In Prelude ##### Attach the partner - Navigate to your user name in upper right hand corner and select "Integrations" - Select the "**Connect**" action for **Microsoft Defender** - Fill out Base URL, Tenant ID, APP ID and App Secret to connect - Base URL should be set to `https://api.securitycenter.microsoft.com`. Optionally can be set to hit one of Microsoft's regional endpoints, example `https://api-.securitycenter.microsoft.com` ##### Detach the partner - Navigate to your user name in upper right hand corner and select "Integrations" - Select the "**Disconnect**" action for **Microsoft Defender** `` - [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content) - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor) - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration) - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations) - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations) - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations) - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations) - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations) - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations) - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations) - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting) - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting) - [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content) - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics) - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations) - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment) - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests) - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression) - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance) - [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content) - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase) - [Account](https://support.preludesecurity.com/account?hsLang=en#main-content) - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso) - [CLI](https://support.preludesecurity.com/cli?hsLang=en) - [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en) [![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com) Prelude Security Knowledge Base Copyright © 2026, Origin Technology