Defender API data not populating in PowerBI

Hi Anonymous
Thank you for reaching out microsoft fabric community forum.

• The Microsoft Defender API (https://api.security.microsoft.com/api/incidents) does not include Insider Risk Management (IRM) incidents.
• IRM incidents are managed under Microsoft Purview and are separated due to privacy and compliance boundaries.
• DLP incidents appear because they are shared between Microsoft Defender and Microsoft Purview.
• To access IRM data, you need to use Microsoft Graph API under the Purview (compliance) umbrella, such as https://graph.microsoft.com/beta/security/insiderRiskCases.
• Microsoft Graph API access requires appropriate Azure AD app registration and permissions like InsiderRiskManagement.Read.All.
• Manual export from the Insider Risk Management portal (CSV) can be used as a workaround if API access isn't feasible.
• Accessing IRM data requires Microsoft 365 E5 Compliance or E5 Security licensing.
• The user accessing the data must have roles such as Insider Risk Management Admin or Compliance Admin.
• Document this limitation in your Power BI dashboard so stakeholders are aware that IRM incidents are excluded due to API constraints.
• Use a custom connector or a Graph API query to bring IRM data into Power BI if automation is required

If this solution helps, please consider giving us Kudos and accepting it as the solution so that it may assist other members in the community
Thank you.