Skip to content
All guidesSecurity & asset platforms

Connect Microsoft Defender to Cybermatic

Create an app registration, grant two Defender read permissions, create a client secret, and enter the three values into Cybermatic.

  1. 1Connect Microsoft Defender to Cybermatic. You will do 3 things inside Microsoft, then enter the information into Cybermatic: 1. Create an App Registration 2. Give it 2 Defender read permissions 3. Create a Client Secret 4. Enter the 3 values into Cybermatic
  2. 2STEP 1 — Open Microsoft Entra. 1. Go to: https://entra.microsoft.com 2. Sign in. Use an account that can: • Create App Registrations • Add API permissions • Grant Admin Consent 3. Open Microsoft Entra ID, then select App registrations. 4. Click + New registration.
  3. 3STEP 2 — Create the Cybermatic App. You should now be on the Register an application screen. Name: enter Cybermatic Defender Scanner Supported account types: select Accounts in this organizational directory only ([Your Company] only — Single tenant). Redirect URI: leave this blank. You do not need a redirect URL. Click Register.
  4. 4STEP 3 — Copy Your Tenant ID and Client ID. Microsoft will take you to the application's Overview page. You need two values from this page. Copy #1 — find Application (client) ID and copy it somewhere temporarily. Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx This will become your Cybermatic Client ID. Copy #2 — find Directory (tenant) ID and copy it. Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx This will become your Cybermatic Tenant ID. At this point you should have: Application (client) ID → Cybermatic Client ID Directory (tenant) ID → Cybermatic Tenant ID Do not close the App Registration yet.
  5. 5STEP 4 — Open API Permissions. Inside your Cybermatic Defender Scanner app, look at the menu on the left. Select API permissions. Delete any existing permissions. Then click + Add a permission.
  6. 6STEP 5 — Find the Defender API. Microsoft will open Request API permissions. Do not choose Microsoft Graph. Instead select the APIs my organization uses tab. Now use the search box. Search: WindowsDefenderATP Select WindowsDefenderATP. This is the Microsoft Defender for Endpoint API.
  7. 7STEP 6 — Select Application Permissions. You should now see permission types. Select Application permissions. Do NOT select Delegated permissions. Cybermatic needs Application permissions because it connects to Microsoft Defender without a user manually signing in each time.
  8. 8STEP 7 — Add Machine.Read.All. Under Application permissions, use the search box. Search: Machine.Read.All Select: ☑ Machine.Read.All This gives Cybermatic permission to read Defender device information. It does not allow Cybermatic to modify the machines.
  9. 9STEP 8 — Add Vulnerability.Read.All. In the same permission screen search: Vulnerability.Read.All Select: ☑ Vulnerability.Read.All This allows Cybermatic to read Microsoft's Defender vulnerability/CVE information.
  10. 10STEP 9 — Add the Permissions. You should now have exactly these two selected: ☑ Machine.Read.All ☑ Vulnerability.Read.All Click Add permissions.
  11. 11STEP 10 — Verify the Permissions. You will return to API permissions. You should see something similar to: WindowsDefenderATP → Machine.Read.All → Application WindowsDefenderATP → Vulnerability.Read.All → Application You want Application, not Delegated.
  12. 12STEP 11 — Grant Admin Consent. This is a very important step. On the API permissions screen, click Grant admin consent for [Your Company]. Microsoft will ask you to confirm. Click Yes. Wait a few seconds. Both permissions should now show: ✅ Granted for [Your Company] Your screen should basically show: WindowsDefenderATP ✅ Machine.Read.All — Type: Application — Status: Granted ✅ Vulnerability.Read.All — Type: Application — Status: Granted If they do not say Granted, stop here. The Cybermatic connection may fail until admin consent is completed.
  13. 13STEP 12 — Create the Client Secret. Stay inside Cybermatic Defender Scanner. On the left side select Certificates & secrets, then select Client secrets. Click + New client secret.
  14. 14STEP 13 — Configure the Secret. For Description enter: Cybermatic Defender Scanner Under Expires, choose 730 days (24 months). A practical choice is 24 months, provided you create a reminder to rotate the secret before it expires. 1. Select Add. 2. Azure displays the new client secret. 3. Immediately copy the entire value from the Value column. Critical distinction: Copy: Value Do not copy: Secret ID The client secret Value is displayed only when it is first created. If you leave the page without copying it, delete that secret and create another one. Store the value securely and record its expiration date.
  15. 15STEP 14 — You Should Now Have 3 Things. Before leaving Microsoft, make sure you have these: 1. Tenant ID — from Directory (tenant) ID 2. Client ID — from Application (client) ID 3. Client Secret — from Certificates & secrets → Client secrets → Value So your Cybermatic information should look like this: Tenant ID ← Directory (tenant) ID Client ID ← Application (client) ID Client Secret ← Client secret Value
  16. 16STEP 15 — Verify Defender Has Devices. Before connecting Cybermatic, make sure Microsoft Defender actually has devices to provide. Open https://security.microsoft.com Go to Assets, then Devices. You should see your Windows servers, workstations, laptops, or other Defender-onboarded endpoints. For example: • PC-001 • LAPTOP-001 • SERVER-01 • SERVER-02 If the device list is empty, Cybermatic will have nothing to import.
  17. 17STEP 16 — Connect Microsoft Defender to Cybermatic. Now leave Microsoft and sign in to Cybermatic. Open Connections. Find Security & asset platforms. Select Microsoft Defender.
  18. 18STEP 17 — Enter the Microsoft Information. Cybermatic should ask for three values. Paste your: Directory (tenant) ID Application (client) ID Client Secret — paste your Client Secret VALUE Click Connect. Cybermatic should authenticate against your Microsoft tenant. The first scan should then start.
  19. 19STEP 18 — Verify It Worked. Inside Cybermatic check Assets. You should start seeing your Microsoft Defender devices. They should be associated/tagged with: Defender. Cybermatic can use Defender's device/exposure information for the imported assets. Removed a device from Defender? It disappears from Cybermatic automatically on the next scan. Then go to Vulnerabilities. You should begin seeing actual CVEs detected through Microsoft Defender. For example: CVE-2026-xxxxx CVE-2025-xxxxx etc.
  20. 20Most common mistakes. 1. Selecting Microsoft Graph instead of WindowsDefenderATP. 2. Selecting Delegated permissions instead of Application permissions. 3. Forgetting Grant admin consent. 4. Copying Secret ID instead of the secret Value. 5. Creating the app in the wrong Microsoft tenant. 6. Defender has no onboarded devices. 7. The client secret expires and is not replaced. If Cybermatic shows an error, these map directly: "the application (client) ID wasn't found in this tenant" → mistakes 1 or 5 — re-copy both IDs from the app's Overview page. "the client secret is invalid or expired" → mistakes 4 or 7 — create a new secret and use Connections → Update credentials. "access denied (403)" → mistakes 2 or 3 — or the tenant has no Defender for Endpoint license.

Tip: The four classic failures, in order of frequency: Microsoft Graph instead of WindowsDefenderATP, Delegated instead of Application permissions, missing admin consent, and copying the Secret ID instead of the Value.

More in Security & asset platforms