Integrate Microsoft Defender Endpoint

Connecting Microsoft Defender Endpoint with Scrut enables your team to continuously monitor device security posture, surface endpoint vulnerabilities, and automate compliance evidence collection.

What This Integration Does in Scrut

• Scrut Monitor: Collects evidence through Scrut Monitor. This helps automate evidence gathering and significantly speeds up compliance workflows.

• Automated Tests: Runs automated checks that continuously evaluate Microsoft Defender Endpoint for security misconfigurations and compliance checks against your applicable compliance frameworks.

• Vulnerability Management: Ingests vulnerability and affected asset data into Scrut, enabling end-to-end vulnerability tracking, assignment, and remediation.

Prerequisites

Before setting up the integration, make sure you have the following in place:

• An active Microsoft Defender Endpoint account

• Admin access to Microsoft Azure to register an application and configure API permissions

• The Application (client) ID, Directory (tenant) ID, and Client Secret Value from the registered Azure application (you will retrieve these during setup)

Permissions and Access Requirements

For Microsoft Defender Endpoint

The integration requires the following read-only API permissions, all as Application permissions (not Delegated):

• Software.Read.All: Read threat and vulnerability management software information

• Machine.Read.All: Read all machine profiles

• Vulnerability.Read.All: Read threat and vulnerability management vulnerability information

For Scrut

• Admin access to Scrut, or Contributor access with permission to the Integrations module

Data Collected

• Devices: Machine name, operating system, and version

• Software: Installed software (Software inventory per device)

• Security findings

  • Vulnerability name (CVE ID and finding title from Defender)

  • Remediation status (Defender remediation state)

  • Severity (Severity rating)

  • Affected resources (Device name)

  • Source (Visible as MS Defender in Scrut)

Sync Frequency

Data is synced automatically once every 24 hours. You can also manually trigger a sync from the integration settings page.

Integration Setup

Pro Tip:

We recommend logging into your Microsoft Defender Endpoint account before starting the integration to avoid doing so later.

Step #1: Create a Service Principal in Azure

Note:

To create a Service Principal, you must register an application in the Azure Active Directory. You need admin access to Microsoft Azure to complete this step.

1. Go to the Azure Home Page.

2. Log in to Microsoft Azure (if required).

3. Select App registrations from Microsoft services.

4. Click + New registration from the top menu.

   

5. The Register an Application page opens.

   

6. In the Application Name field, enter the value Scrut Defender.

7. Under Account Type, select Accounts in this organizational directory only ([Default Directory] only - Single tenant).

8. Click Register.

9. On the application overview page, copy and save the Application (client) ID and Directory (tenant) ID.

Step #2: Add API Permissions to the Registered Application

1. Select API permissions from the left navigation menu.

2. Click + Add a permission.

   
   

3. Select APIs my Organization uses.

4. In the search field, enter Windows and select WindowsDefenderATP.

   
   

5. Click Application permissions.

6. In the Select permissions search software, select Software.Read.All.

7. Search Machine and select Machine.Read.All.
   

8. Search Vulnerability and select Vulnerability.Read.All.

9. Click Add Permissions.

10. Click Grant admin consent for Scrut.

11. Click Yes to confirm.

Important:

All three permissions must show Granted status before proceeding. If any show Not granted, the integration will not function correctly.

Step #3: Create a Client Secret for the Registered Application

1. Select Certificates & secrets from the left navigation menu.

2. Click + New Client Secret.

3. Enter a Description for the secret.

4. Select an expiry duration from the Expires dropdown menu.

5. Click Add to save the new Client Secret.

6. Copy the Client Secret Value (third column) for later use. This is your Client Secret Value.

Important:

Copy the Client Secret Value immediately after creation. Azure does not show this value again after you navigate away from the page. Do not copy the Secret ID; only the Value is required.

Step #4: Connect the Integration in Scrut

1. Sign in to Scrut, and click Integrations → Integrations Library.

2. In the Categories section, scroll to Vulnerability Scanners.

3. Click the Integrate button in the Microsoft Defender Endpoint tile.

   

4. On the credentials form, enter the following:

   • Account Name: The display name for this integration

   • Client ID: The Application (client) ID from Step 1

   • Client Secret: The Client Secret Value from Step 3

   • Tenant ID: The Directory (tenant) ID from Step 1

5. Click Submit.

Watch for the success toast and the Connected status indicator on the Microsoft Defender Endpoint integration page.

Step #5: Configure Scope

After completing the integration, configure the scope by selecting the devices to include in the scan.

1. Go to Integrations → Connected Integrations → Vulnerability Scanners.

2. Click the Configure button on the Microsoft Defender Endpoint integration.

   

3. On the MS Defender integration page, click the three-dot icon in the Actions column, and choose the devices you want to include in the integration scope.

4. Select the topmost checkbox to select all devices at once.

5. Click Save.

   

What Happens Next?

Initial data sync

The initial sync begins automatically after the integration is connected and the scope is saved. It takes up to 24 hours for the first scan results to appear in Scrut. To check sync status, navigate to Integrations, open the Microsoft Defender Endpoint integration page, and review the Audit Logs tab.

Review synced data

Once the sync completes, you can find the data in the following locations:

• Navigate Vulnerabilities → Third-Party Scans to view all vulnerabilities ingested from Defender. Use the Source filter and select MS Defender to view only Defender-sourced findings.

• Navigate to Tests → Automated Tests, and use the Application filter to view only tests specific to Defender.

• Navigate to Compliance → Evidence Tasks, open any evidence, and click Add Attachment to configure a Scrut Monitor to automated evidence collection from Defender.

Heads Up!

If results are not visible after 24 hours, check the Audit Logs on the Microsoft Defender Endpoint integration page to confirm whether the scan completed successfully.

Common Errors and Troubleshooting

Integration fails to connect

Possible solutions:

• Verify that the Client ID, Client Secret Value, and Tenant ID are entered correctly. Do not enter the Secret ID in place of the Client Secret Value.

• Confirm that admin consent has been granted for all three API permissions in Azure. All permissions must show Granted status.

• Ensure the registered application in Azure is set to Single tenant and is associated with the correct directory.

Vulnerabilities not appearing in Scrut

Possible solutions:

• Allow up to 24 hours for the initial sync to complete.

• Check the Audit Logs tab on the Microsoft Defender Endpoint integration page to confirm the scan ran successfully.

• Verify that at least one device is selected in the Configure Scope panel. If no devices are in scope, no data is collected.

Missing devices in scope selection

Possible solutions:

• Confirm that the devices are enrolled and active in Microsoft Defender Endpoint.

• Check that the Machine.Read.All permission is granted and active on the registered Azure application.

FAQs

Reach out to support@scrut.io or contact your CSM for further assistance.