Daily Defender News
Aboutmerill.net
Cross-product topic

Developer and API

A cross-product view of Microsoft Defender changes related to Developer and API.

Latest Developer and API changes

Create Azure Devops Connector

Developer and API

The instructions now direct administrators to Agentic code scanning management, select Add another beside Source code environment, and choose Azure DevOps to open the connector flow.

Create Github Connector

Developer and API

The guide now instructs administrators to select GitHub under Source code environment, rather than Azure DevOps, and proceed to the GitHub connector flow.

Normalization Schema Process Event

Developer and API

The page now documents `imProcessEvent` for querying all process event types, retains specialized parsers, revises custom parser naming guidance, and updates the filtering example.

Create Github Connector

Developer and API

The instructions now direct administrators to Agentic code scanning management, select Add another under Source code environment, and choose Azure DevOps. Connector naming remains optional.

Data Connector Ui Definitions Reference

Developer and API

The data connector UI definitions reference now uses the corrected relative link to the Create a codeless connector documentation.

Api List Incidents

Developer and API

The documentation now explains that incident properties, including severity, may change after creation. Applications should poll `lastUpdateTime` and compare current values with retained values; severity cannot be filtered server-side.

Configure Connector Login Detection

Developer and API

The documentation now highlights that the machine learning algorithm needs 30 days of Windows Security events to establish a user-behavior baseline before detecting incidents.

Connect Mdti Data Connector

Developer and API

The documentation now explicitly identifies intelligence ingested from the Defender Threat Intelligence connector, while updating related links and page metadata.

Connect Services Api Based

Developer and API

The article now says table names are listed under each connector in the Data connectors reference and adds a Microsoft Entra ID Protection example. Documentation metadata was also updated.

Connect to Microsoft Sentinel using a Unified Connector

Developer and API

The article now uses updated navigation and permission guidance, identifies the Okta API token explicitly, and warns that deleting a connector stops ingestion, removes its configuration, and cannot be undone.

Connect your TIP with the upload API (Preview)

Developer and API

The article now identifies the upload API as a preview API, clarifies STIX-supported uploads and prerequisites, renames the configuration section, and updates related links and permission wording.

Create a pull codeless connector for Microsoft Sentinel

Developer and API

The article distinguishes pull/polling connectors from push connectors and focuses its instructions on connectors that periodically fetch data through APIs. It also links to the Microsoft Sentinel Visual Studio Code extension.

Create an Azure DevOps connector for agentic code security

Developer and API

Documentation now describes connecting Azure DevOps organizations to Microsoft Defender for repository discovery and remote on-demand agentic code scans, with optional write access for remediation workflows.

Create pull codeless data connectors using nested API polling

Developer and API

Microsoft Sentinel now documents how to build Codeless Connector Framework pull connectors that chain parent and child REST API calls, including configuration of nested polling in RestApiPoller connection rules.

Create Push Codeless Connector

Developer and API

The documentation changed “Next steps” to “Related content” and “Getting help” to “Get help.”

Data Connector Connection Rules Reference

Developer and API

The documented maximum for both `RequestTimeoutInSeconds` and `TimeoutInSeconds` increased from 180 to 300 seconds. Their default values remain 100 and 20 seconds, respectively.

Deploy Data Connector Agent Container

Developer and API

The documentation page for connecting SAP systems to Microsoft Sentinel was deleted, including guidance for both the agent and agentless connector options, prerequisites, and deployment steps.

Develop Custom Graph Solutions for Microsoft Sentinel

Developer and API

The new guide explains how to build, test, materialize, query, package, and publish notebook-based custom graph solutions using Sentinel data lake tables and Graph Query Language. It also documents prerequisites, permissions, tools, and the preview status.

Enable API security posture with Defender CSPM

Developer and API

The page now states that disabling the API posture extension offboards all APIs from the Defender CSPM plan and disables API security posture management. It also updates related link text and the Azure free account wording.

Graph Visualization

Developer and API

The documentation now explains that only graphs materialized by published graph jobs appear in Graph management, on-demand job graphs are retained for 30 days, scheduled jobs rebuild graphs, and graph queries incur graph-meter charges. It also notes that predefined queries use a default LIMIT clause that can cap visualization results.

Investigate activities using the API

Developer and API

The article now describes scanning and retrieving large volumes of activity data, clarifies pagination wording, and reorganizes the next-steps links under Related content.

Investigation graph

Developer and API

The article’s metadata was refreshed, and wording and link formatting were updated in the investigation graph and threat intelligence instructions.

Manage IP address ranges using the API

Developer and API

The article now provides clearer coverage of Data Enrichment API operations, Python CSV synchronization, pagination using `nextQueryFilters`, deletion behavior, and Defender for Cloud Apps support.

Migrate to the Microsoft Sentinel agentless SAP data connector

Developer and API

The guide now states that Microsoft will permanently retire and disable the containerized SAP connector agent on September 14, 2026. It also directs new deployments to the agentless connector and confirms existing analytics rules, workbooks, and playbooks remain functional.

Monitor Data Connector Health

Developer and API

The article now identifies SentinelHealth as a Microsoft Sentinel log table for supported data connector health events and improves the health-drift query reference. The publication date and authoring metadata were also updated.

Normalization Schema Asset

Developer and API

The asset normalization schema now uses “Microsoft Entra” terminology instead of “Azure Active Directory” and updates the identity-directory example accordingly.

Offboard Machine Api

Developer and API

The documented supported platforms now include macOS 14 and later and supported Linux distributions, alongside the existing Windows versions. On Windows, the API still stops the sensor without removing registry onboarding information.

Retrieve attack path data with the Azure Resource Graph API

Developer and API

The page title and description now identify the Azure Resource Graph API. The example explains filtering attack path resources by subscription and display name, and the next-steps section received a navigation anchor.

Run Advanced Query Api

Developer and API

The page now states that the Defender for Endpoint advanced hunting API is old and limited, and is transitioning to the Microsoft Graph security API, which offers broader data coverage, improved consistency, and better scalability.

Schedule antivirus scans using PowerShell

Developer and API

The documentation now states that after two missed scheduled quick scans, a catch-up scan runs when the device powers on or resumes from sleep or hibernation, rather than when someone signs in.

Secure OAuth apps accessing non-Graph APIs using app governance

Developer and API

The article now has an Overview section and revised wording explaining visibility into OAuth apps that access Microsoft Graph and other APIs. It also clarifies that the Permissions tab lists Graph and non-Graph API permissions.

Sentinel Graph Overview

Developer and API

The page now explains how to author a custom graph in a Jupyter notebook with the Microsoft Sentinel VS Code extension, publish and materialize it with a graph job, and query or visualize it with GQL in the Defender portal.

Sentinel Mcp Chatgpt Claude Connector

Developer and API

The documentation was updated with clearer wording for securely saving the one-time client secret, separate ChatGPT and Claude setup guidance, and a clarification that ChatGPT desktop users must first complete custom connector setup on the web.

Set up continuous export with REST API

Developer and API

The page date and authoring metadata were updated, the Azure subscription signup text now says “free Azure account,” and the “Next step” heading was changed to “Next steps” with an anchor added.

Setup Azure Storage Connector

Developer and API

The page’s date and authoring metadata were updated, and descriptions of the queue-based blob-pointer model and service-principal authentication were refreshed.

Streaming Api

Developer and API

The streaming API documentation now refers to configuring Microsoft Defender, instead of Microsoft Defender XDR, to stream Advanced Hunting events to Azure Event Hubs or Azure storage.

Streaming Api Storage

Developer and API

The documentation now refers specifically to user accounts and service principals for Contributor role assignments, clarifies the trusted Microsoft services setting, and adds guidance for interpreting blob event records and querying their schema.

Support Multiple Connections in a Codeless Connector

Developer and API

New guidance explains how to build a Microsoft Sentinel codeless connector with multiple simultaneous source connections in one workspace, using SailPoint IdentityNow as an example.

Terraform API Setup

Developer and API

The article now explains how to create custom IAM roles, service accounts, workload identity resources, and Pub/Sub resources with Terraform, plus clearer validation and Azure Government references.

Update SAP connector and DCR settings

Developer and API

A new article explains how to update SAP data connectors and data collection rules independently, including polling settings, connector resource selection, and API Playground examples.

Update Sap Data Connector

Developer and API

The Microsoft Sentinel for SAP applications article describing SAP data connector agent updates, including preview automatic-update procedures, prerequisites, and commands, was deleted.

Access Den Graph Api

Developer and API

Removed Microsoft Defender documentation in defender-xdr/access-den-graph-api.md.

Api Access

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-access.md.

Api Create App User Context

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-create-app-user-context.md.

Api Create App Web

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-create-app-web.md.

Api Hello World

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-hello-world.md.

Api List Incidents

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-list-incidents.md.

Api Overview

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-overview.md.

Api Partner Access

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-partner-access.md.

Api Update Incidents

Developer and API

Updated Microsoft Defender documentation in defender-xdr/api-update-incidents.md.

Create Custom Connector

Developer and API

Updated Microsoft Defender documentation in sentinel/create-custom-connector.md.

Graph Visualization

Developer and API

Updated Microsoft Defender documentation in sentinel/datalake/graph-visualization.md.

Query Enterprise Exposure Graph

Developer and API

Updated Microsoft Defender documentation in exposure-management/query-enterprise-exposure-graph.md.

Respond to a compromised connector

Developer and API

Updated Microsoft Defender documentation in defender-office-365/connectors-detect-respond-to-compromise.md.

Sentinel Mcp Graph Tool

Developer and API

Removed Microsoft Defender documentation in sentinel/datalake/sentinel-mcp-graph-tool.md.

Create Codeless Connector

Developer and API

Removed Microsoft Defender documentation in sentinel/create-codeless-connector.md.

Create Custom Connector

Developer and API

Updated Microsoft Defender documentation in sentinel/create-custom-connector.md.