Microsoft Defender for Endpoint

Create Power BI reports with Microsoft Defender for Endpoint APIs

4 September 2026Doc update+10 / −7 lines

In brief

The article was retitled and its instructions now explain how to connect Power BI to the Advanced Hunting API and OData API, including what each example query retrieves.

What Defender admins need to know

Administrators get clearer guidance for building Power BI reports from Defender for Endpoint query results; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create custom reports using Power BI

[!INCLUDE Improve request performance]

~~In this section, you learn to create a~~Create Power BI ~~report~~reports on top of Defender for Endpoint APIs.

The first example demonstrates how to connect Power BI to Advanced Hunting API, and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts.

Connect Power BI to Advanced Hunting API

Perform the following steps to connect Power BI to the Advanced Hunting API and build a report from query results.

Open Microsoft Power BI.
Select Get Data > Blank Query.
:::image type="content" source="../media/power-bi-open-advanced-editor.png" alt-text="The Advanced Editor menu item" lightbox="../media/power-bi-open-advanced-editor.png":::
Copy the code snippet below and paste it in the ~~editor:~~editor. This query uses the Advanced Hunting API to retrieve up to 20 DeviceEvents entries where the action type contains "Anti", and maps the response schema to Power BI data types:
```
    let
```

Connect Power BI to OData APIs

The only difference ~~from~~between the ~~previous~~Advanced Hunting API example and ~~this~~the OData API example is the query inside the editor.

Open Microsoft Power BI.

:::image type="content" source="../media/power-bi-open-advanced-editor.png" alt-text="The Advanced Editor menu item" lightbox="../media/power-bi-open-advanced-editor.png":::
Copy the following code, and paste it in the ~~editor~~editor. This query uses the OData API to ~~pull~~retrieve all Machine Actions from your ~~organization:~~organization, which you can use to build reports on response activities such as device isolation or antivirus scans:
```
    let
```

@@ -1,5 +1,5 @@ ----title: Microsoft Defender for Endpoint APIs connection to Power BI+title: Create Power BI reports with Microsoft Defender for Endpoint APIs ms.reviewer: yongrhee description: Create a Power Business Intelligence (BI) report on top of Microsoft Defender for Endpoint APIs. ms.service: defender-endpoint@@ -12,10 +12,11 @@ ms.collection: - must-keep ms.topic: how-to ms.subservice: reference-ms.custom: api-ms.date: 01/08/2026+ms.custom: api, msecd-doc-authoring-1016+ms.date: 07/02/2026 appliesto:   - Microsoft Defender for Endpoint+ai-usage: ai-assisted ---  # Create custom reports using Power BI@@ -24,12 +25,14 @@ appliesto:  [!INCLUDE [Improve request performance](../../includes/improve-request-performance.md)] -In this section, you learn to create a Power BI report on top of Defender for Endpoint APIs.+Create Power BI reports on top of Defender for Endpoint APIs.  The first example demonstrates how to connect Power BI to Advanced Hunting API, and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts.  ## Connect Power BI to Advanced Hunting API +Perform the following steps to connect Power BI to the Advanced Hunting API and build a report from query results.+ 1. Open Microsoft Power BI.  2. Select **Get Data** \> **Blank Query**.@@ -40,7 +43,7 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API,     :::image type="content" source="../media/power-bi-open-advanced-editor.png" alt-text="The Advanced Editor menu item" lightbox="../media/power-bi-open-advanced-editor.png"::: -4. Copy the code snippet below and paste it in the editor:+4. Copy the code snippet below and paste it in the editor. This query uses the Advanced Hunting API to retrieve up to 20 `DeviceEvents` entries where the action type contains "Anti", and maps the response schema to Power BI data types:     ```dax        let@@ -100,7 +103,7 @@ Now the results of your query appear as a table and you can start to build visua  ## Connect Power BI to OData APIs -The only difference from the previous example and this example is the query inside the editor.+The only difference between the Advanced Hunting API example and the OData API example is the query inside the editor.  1. Open Microsoft Power BI. @@ -112,7 +115,7 @@ The only difference from the previous example and this example is the query insi     :::image type="content" source="../media/power-bi-open-advanced-editor.png" alt-text="The Advanced Editor menu item" lightbox="../media/power-bi-open-advanced-editor.png"::: -4. Copy the following code, and paste it in the editor to pull all **Machine Actions** from your organization:+4. Copy the following code, and paste it in the editor. This query uses the OData API to retrieve all **Machine Actions** from your organization, which you can use to build reports on response activities such as device isolation or antivirus scans:     ```dax        let