Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Create an app to access Microsoft Defender for Endpoint without a user

4 September 2026Doc update+19 / −13 lines

In brief

The article now provides clearer steps for app registration, app permissions, OAuth 2.0 client credentials authentication, consent, token retrieval and validation, and authenticated API requests.

What Defender admins need to know

Administrators can use the revised guidance to configure and validate application access. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create an app to access Microsoft Defender for Endpoint without a user

When using Microsoft Defender for Endpoint APIs, you might need access to Microsoft Defender for Endpoint without a user. For example, you might want to create a service that runs in the background and interacts with Defender for Endpoint on behalf of your organization. In this case,If you need tobackground service access without a signed-in user, create an application that can access Defender for Endpoint without a user.

This article shows how to register an application in Microsoft Entra ID, grant it app-only permissions, and obtain an access token for Defender for Endpoint API access. API access requires OAuth 2.0 client credentials flow.

Prerequisites

Having the Microsoft Entra role for creatingTo create an app registration in Azure. For example,Azure, you need a Microsoft Entra role with app registration permissions that allows app creation, such as Application Administrator.

Step 1: Create an app in Azure

Perform the following steps to register an app and grant it API permissions in Azure:

  1. Sign in to the Azure portal.

  2. Search for App registrations and navigate to App registrations.

Step 2: Add a secret to your app

This section describes authenticatingThe following steps describe how to authenticate your app using an app secret. To authenticate your app using a certificate, see Create a self-signed public certificate to authenticate your application.

  1. From the application page, select Certificates & secrets > New client secret.

Once you run your app, you need it to be approved in each tenant where you intend to use it. This is because your application interacts with Defender for Endpoint on behalf of your customer. You or your customer, will need to select the consent link and approve your app. Give consent with a user who has admin privileges.

Here's how to form the consent link. When a tenant admin visits this URL, the Microsoft identity platform consent flow opens so the customer tenant can authorize the app. Replace 00000000-0000-0000-0000-000000000000 with your app ID. 

https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=00000000-0000-0000-0000-000000000000&response_type=code&sso_reload=true

## Get an access token

This section lists a fewThe following methods for gettingshow how to get your app's [access token](/entra/identity-platform/v2-oauth2-client-creds-grant-flow#get-a-token).

  1. Set TENANT_ID to the Azure tenant ID of the customer that wants to use your app to access Defender for Endpoint.

  2. Run the following command to request an app-only access token from the Microsoft identity platform and return it for use in subsequent API calls: 

    curl -i -X POST -H "Content-Type:application/x-www-form-urlencoded" -d "grant_type=client_credentials" -d "client_id=%CLIENT_ID%" -d "scope=https://api.securitycenter.microsoft.com/.default" -d "client_secret=%CLIENT_SECRET%" "https://login.microsoftonline.com/%TENANT_ID%/oauth2/v2.0/token" -k

    A successful response returns a JSON object that contains the bearer token type, expiration time (in seconds), and the access_token value you use for API calls. The response resembles the following example: 

     {"token_type":"Bearer","expires_in":3599,"ext_expires_in":0,"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIn <truncated> aWReH7P0s0tjTBX8wGWqJUdDA"}

Validate the token

Follow the token-validation steps below to ensure that you got the correct token. You can send more than one request with the same token. The token expires in an hour.

  1. Copy and paste the access token you obtained in the previous step into JWT decoder (jwt.ms) to decode it.

  2. Validate that you get a roles claim with the desired permissions.

Use the token to access Microsoft Defender for Endpoint API

After you obtain a valid token, use it in your API requests as follows:

  1. Choose the supported Defender for Endpoint API you want to use.

  2. Set the authorization header in the http request you send to Bearer {token}. Bearer is the authorization scheme.

Example

This exampleThe following C# snippet sends aan authenticated GET request to get athe Defender for Endpoint alerts endpoint, using the bearer token obtained earlier, and retrieves the list of alerts using C#.alerts.

var httpClient = new HttpClient();