> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Defender for Endpoint
> Connect Microsoft Defender for Endpoint in your clients' tenants to Triggr with your own multitenant Microsoft Entra app registration.
Triggr works with custom indicators (allow, audit, warn and block), devices and alerts in each client's Defender for Endpoint. It uses its own app registration, separate from your [Microsoft Graph (GDAP)](/integrations/microsoft-graph/gdap-service-account) connection.
## Set up Microsoft Entra
Register one multitenant app in your own tenant (you need a role such as Application Administrator); every client uses it. See Microsoft's [Partner access through Microsoft Defender for Endpoint APIs](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-partners).
In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > App registrations > New registration**, name it `Triggr Defender for Endpoint`, choose **Multiple Entra ID tenants** (or Accounts in any organizational directory), select Register and copy the Application (client) ID.
In Authentication, select **Add Redirect URI** (or Add a platform), choose Web, enter `https://app.triggr-app.com/oauth/admin-consent-callback` and select Configure.
In API permissions, select **Add a permission > APIs my organization uses**, type `WindowsDefenderATP`, choose Application permissions and tick what your workflows need.
| Triggr actions | Application permission |
| - | - |
| List Indicators, Submit or Update Indicator, Import Indicators, Delete Indicator, Batch Delete Indicators | `Ti.ReadWrite.All` |
| List Machines | `Machine.Read.All` or `Machine.ReadWrite.All` |
| Get Machine | `Machine.ReadWrite.All` |
| List Alerts | `Alert.ReadWrite.All` |
In **Certificates & secrets > Client secrets**, select New client secret, choose an expiry (up to 24 months) and copy the Value, not the Secret ID.
## Connect it in Triggr
Each client needs Defender for Endpoint Plan 1 or 2, or Defender for Business, with devices onboarded. Per-client integrations never fall back to the Base Configuration when a workflow runs for a client.
Go to **Integrations > Microsoft Defender for Endpoint** and click Configure on the Base Configuration card.
Enter the Application (client) ID, the secret's Value as Client Secret and your own tenant ID as Microsoft Tenant ID (used only by runs without a client), then click Save Configuration. There's no Authorize step, and this card's Admin Consent can stay Not Granted unless you run Defender actions without a client.
On the Per-Client Configuration card, click Configure on the client's row, enter its Microsoft Tenant ID (or use Lookup By Domain) and click Save Configuration. Triggr saves it as the client's `microsoftTenantId` variable; for clients that already have that variable, click Automap, then Approve All.
Click **Admin Consent** on the client's row, sign in as a Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator of the client's tenant and select Accept. If you add a permission to the app later, grant consent again.
To rotate the secret, create a new one in Entra and replace Client Secret with Edit on the Base Configuration card. One change covers every client.
## Troubleshooting
The client has no configuration. Add its tenant ID in the Per-Client Configuration card, then grant admin consent for it.
AADSTS50011: add the redirect URI above to the app exactly. AADSTS700016: the client hasn't consented yet, the app isn't multitenant, or Application (client) ID is wrong.
The client's tenant has no Defender for Endpoint. Check it has a Defender for Endpoint or Defender for Business licence and is set up in the Defender portal, then try again.
The secret is the Secret ID instead of the Value (7000215) or has expired (7000222), or the client's Microsoft Tenant ID is wrong (90002).
The app lacks the Application permission the action needs, or you added it after the client consented: click Admin Consent again.
The tenant has no recently seen devices. Check devices are onboarded and reporting in the client's Defender portal. Get Machine returns 404 when no device matches the ID or computer name.
In the client's [Defender portal](https://security.microsoft.com), under Settings > Endpoints > General > Advanced features, turn on Custom network indicators (IP, URL and domain) or Allow or block file (file hashes). IP indicators take single public addresses, not ranges, and network indicators can take up to 48 hours to apply.
Defender limits most calls to 100 a minute and 1,500 an hour, and Import Indicators and Batch Delete Indicators to 30 a minute. Use the bulk actions and spread large jobs out.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.