Microsoft Defender for Endpoint

Proofroom reads Defender for Endpoint with an app registration’s application permissions: devices and antivirus health from the Defender API, and alerts from Microsoft Graph. Add it on Integrations → Catalogue → Microsoft Defender for Endpoint → Connect.

What each collector shows

Collector	Kind	Default cadence	What it shows	Suggested controls
Anti-malware coverage	snapshot	monthly	Every onboarded device (devices Defender only discovered on the network are left out) with its antivirus mode from the antivirus health report: active blocks; passive, passive audit and EDR in block mode do not block on their own; disabled is off. Up to date is Defender’s own reading of signatures, engine and platform; the signature update time is shown. Each agent’s problems are listed: detect only, protection off, not seen for 7 days (or the number you set), out of date; agents whose currency the vendor does not report are counted as currency unknown, not as current.	PCI DSS 5.2.1, 5.2.2, 5.3.1; SOC 2 CC6.8
Endpoint alerts and response	window	monthly	Defender for Endpoint alerts raised in the window from Microsoft Graph security alerts, and high-severity ones raised earlier that are not resolved. Defender’s highest severity is high. Counts by severity, median days to resolve, and every high or critical alert still open with its age.	PCI DSS 12.10.5; SOC 2 CC7.2, CC7.3

The agent list feeds the Endpoint coverage built-in, which compares it with your device manager’s inventory, and the Endpoints posture score.

Create the app registration

In the Microsoft Entra admin center, go to Entra ID → App registrations → New registration. Name it “Proofroom” and register it. Note the Application (client) ID and Directory (tenant) ID. Then create a client secret.
API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions → Machine.Read.All.
Add a permission → Microsoft Graph → Application permissions → SecurityAlert.Read.All, and optionally Application.Read.All so Proofroom can read when the client secret expires.
Select Grant admin consent for your directory.

Defender’s own alert API documents only Alert.ReadWrite.All, which can change alerts, so Proofroom reads alerts through Microsoft Graph instead. One app registration can serve Intune and Defender together.

Connect

Field	Value
Directory (tenant) ID, Application (client) ID, Client secret	From step 1
Region	global, unless your tenant must use a regional API (us, eu, uk, au)
`staleDays`	7 by default

Test connection reads one machine and one security alert, naming the permission to grant for either.

Known limits

EDR in block mode (antivirus mode 4) means another antivirus is primary. Proofroom shows it as detect only, the safe reading; check the other antivirus with its own connection.
The antivirus health report (/api/deviceavinfo) is not marked generally available on Microsoft’s page (UNVERIFIED). A device without a report shows protection unknown.
UNVERIFIED: the answer for a tenant without Defender for Endpoint (DisabledFeature is reported as “not set up”). Defender answers 404 when it has no recently seen machines; that is filed as no agents, with a note.
UNVERIFIED: $filter on serviceSource together with createdDateTime on Graph security alerts. Alerts are also filtered by Proofroom after reading.