Defender API data not populating in PowerBI

[NMerino]

Hello,

My team is trying to create a PowerBI dashboard utilizing microsoft defender incident data (security.microsoft.com) .

We created an API connection through the OData feed source:  OData.Feed("https://api.security.microsoft.com/api/incidents", null, [Implementation="2.0"])

Most of the incidents I see on the defender portal are ingested into PowerBI, however, it is missing insidents from the Insider Risk Management source, and I am only able to see DLP incidents for some reason. We have tried numerous troubleshootings with no success, any help would be appreciated.

Below I have attached screenshots of what the power BI raw data that we're getting from defender looks like vs what the microsoft defender protal is showing.

Defender Portal:

PowerBI Source Data:

[v-shamiliv]

Hi @NMerino 

I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.
Thank you.

[v-shamiliv]

Hi @NMerino 
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[v-shamiliv]

Hi @NMerino 

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-shamiliv · Accepted solution]

Hi @NMerino
Thank you for reaching out microsoft fabric community forum.

• The Microsoft Defender API (https://api.security.microsoft.com/api/incidents) does not include Insider Risk Management (IRM) incidents.
• IRM incidents are managed under Microsoft Purview and are separated due to privacy and compliance boundaries.
• DLP incidents appear because they are shared between Microsoft Defender and Microsoft Purview.
• To access IRM data, you need to use Microsoft Graph API under the Purview (compliance) umbrella, such as https://graph.microsoft.com/beta/security/insiderRiskCases.
• Microsoft Graph API access requires appropriate Azure AD app registration and permissions like InsiderRiskManagement.Read.All.
• Manual export from the Insider Risk Management portal (CSV) can be used as a workaround if API access isn't feasible.
• Accessing IRM data requires Microsoft 365 E5 Compliance or E5 Security licensing.
• The user accessing the data must have roles such as Insider Risk Management Admin or Compliance Admin.
• Document this limitation in your Power BI dashboard so stakeholders are aware that IRM incidents are excluded due to API constraints.
• Use a custom connector or a Graph API query to bring IRM data into Power BI if automation is required

If this solution helps, please consider giving us Kudos and accepting it as the solution so that it may assist other members in the community
Thank you.