Microsoft Defender for Endpoint

What You'll Need

Get Your Credentials

If you have already set up the Microsoft Entra ID adapter, you can reuse the same app registration — just add the additional API permissions listed below and re-grant admin consent. See the Microsoft Entra ID guide for the full app registration walkthrough.

In the Azure portal, go to App registrations and select your Clariti app (or create a new one). Under API permissions > Add a permission > APIs my organization uses, search for and select WindowsDefenderATP (this is Defender for Endpoint's own API — a separate entry from Microsoft Graph). Add the following Application permissions:

• Machine.Read.All
• Alert.Read.All
• Vulnerability.Read.All
• Software.Read.All
• Score.Read.All

Click Grant admin consent for your tenant. Then go to Certificates & secrets, create a new client secret, and copy its value. You will also need the Application (client) ID from the Overview page and the Directory (tenant) ID.

Internet-facing devices. Clariti also reads which machines Defender has flagged as internet-facing (the IsInternetFacing device attribute, via Microsoft Graph advanced hunting). This uses the Microsoft Graph permission ThreatHunting.Read.All, which the one-click Connect Microsoft 365 flow requests; connections consented before it was added see a re-consent banner on the dashboard. Without it, device exposure is simply treated as unknown: nothing is marked internal, and everything else syncs normally. A manual app-registration connection holds a Defender-only token, so this signal is not available there.

Enter Credentials in Clariti

Verify Connection

Click Test Connection in Clariti. A successful connection returns a green checkmark. The first data sync typically completes within a few minutes.

Troubleshooting

• 401 Unauthorized — The client secret may have expired. Generate a new secret in Azure and update it in Clariti.
• 403 Forbidden — Verify that admin consent was granted for all five permissions. Check in Enterprise applications > Clariti > Permissions. A tenant connected before Software.Read.All or Score.Read.All existed on this list will see software-inventory or exposure/configuration-score data skipped (with everything else unaffected) until an admin adds the missing permission and re-grants consent.
• Timeout — Large tenants with many machines may take longer for the initial sync. Clariti retries automatically.
• Very large fleets (100+ machines) — Per-device CVE detail is fetched at a throughput-bounded rate for your highest-risk machines; the remaining machines get their vulnerability count from Defender's bulk vulnerability export instead. A machine Clariti could not measure in a sync (for example a device Defender discovered but has not onboarded) shows its patch status as not measured rather than as up to date. A machine Defender has not yet assessed for vulnerabilities (it is not in Defender's vulnerability export, which Microsoft refreshes every six hours) also shows its patch status as not measured, whatever the fleet size.
• Exploited-vulnerability evidence — Each device's vulnerability list also feeds Clariti's exploited-vulnerability evidence: when Defender reports a CISA KEV-listed vulnerability in Windows (including Win32k, Internet Explorer and .NET Framework) on a device, that device counts as confirmed exposure (see How your score is calculated). Other KEV-listed vulnerabilities stay on their Defender vulnerability finding. A device counts as checked only after Defender has fully assessed it within the last 7 days against the current KEV list; until then a matching Windows KEV shows as a potential exposure.