Defender for Endpoint - MSSP Reporting without Organisational Accounts

Hi Anonymous ,

Please try below steps:

1. Register an Application in Azure AD:
- Go to the Azure portal and navigate to Azure Active Directory.
- Select "App registrations" and then "New registration."
- Enter the application details and register the application.

 

2. Grant API Permissions:
- Once the app is registered, go to "API permissions" within the app registration in Azure AD.
- Click "Add a permission," choose "APIs my organization uses," and search for "Microsoft Defender for Endpoint."
- Add the necessary permissions required for the API calls you will be making.

 

3. Generate Client Secret:
- In the same app registration, go to "Certificates & secrets."
- Create a new client secret and make a note of the value; you will need this for authentication.

 

4. Get Tenant ID and Client ID:
- Your Tenant ID and Client ID can be found in the Azure AD directory overview and the app registration overview, respectively.

 

5. Authenticate Using OAuth and Retrieve Token:
- You will need to authenticate using OAuth to get an access token. This will typically involve sending a POST request to the Microsoft identity platform token endpoint with the necessary credentials (Tenant ID, Client ID, Client Secret).

 

6. Pull Data from Defender for Endpoint:
- Use the access token to authenticate API calls to Defender for Endpoint. Make sure to specify the correct tenant ID in your API requests to access the customer's data.

 

7. Connect to Power BI:
- In Power BI Desktop, select "Get Data."
- Choose "Web" as the data source and format your API URL to retrieve the data from Defender for Endpoint.
- Use the advanced options to include the necessary HTTP request header for authorization with the bearer token you obtained.

 

8. Schedule Refresh in Power BI Service:
- Once your report is published to Power BI Service, you will need to configure the dataset to refresh by providing the necessary API connection details and setting up a refresh schedule.

 

Best regards,
Community Support Team_Binbin Yu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.