> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender

> Connect Microsoft Defender to Myrmex — triage alerts and incidents across your XDR estate on demand.

import { Note, Steps, Step, CardGroup, Card } from '@mintlify/components';

Connect **Microsoft Defender** (Defender XDR) so Myrmex can read alerts, incidents, and risk signals across endpoints, identities, apps, and email, and help you triage them. Myrmex connects from the cloud over **Microsoft Graph** after you grant admin consent — reading in real time, on demand, with **no Collector required** and nothing stored on the Myrmex side.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Alerts & incidents" icon="bell">
    Read Defender XDR alerts and incidents for live triage.
  </Card>

  <Card title="Endpoint & identity signals" icon="laptop">
    Review device, identity, and app risk across the estate.
  </Card>

  <Card title="Threat context" icon="magnifying-glass">
    Correlate Defender findings with the rest of your connected stack.
  </Card>

  <Card title="Guided response" icon="wrench">
    Get recommended next steps for incidents, with approval for any action.
  </Card>
</CardGroup>

## Before You Start

Microsoft Defender connects from the cloud — **no Collector is required**. You'll need:

* A **Microsoft Defender** tenant and your **Tenant ID**.
* An account with the **Global Administrator** (or **Security Administrator**) role, to grant tenant-wide admin consent.

## Step 1 — Create the Credential in Microsoft

<Steps>
  <Step title="Find your Tenant ID">
    In the **Microsoft Entra admin center**, open **Overview** and copy the **Tenant ID** (Directory ID).
  </Step>

  <Step title="Confirm your role">
    Make sure your account can grant tenant-wide admin consent — **Global Administrator** or **Security Administrator**.
  </Step>

  <Step title="Grant consent during Connect">
    Myrmex uses a pre-registered application. When you add the integration you'll be redirected to Microsoft to review and grant the requested read permissions.
  </Step>
</Steps>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Microsoft Defender**, then fill in:

| Field         | Description                                 |
| ------------- | ------------------------------------------- |
| **Tenant ID** | Your Microsoft Entra directory (tenant) ID. |

<Note>
  When you connect, you're redirected to Microsoft to sign in and grant admin consent. The authentication method and the set of granted permissions are captured automatically during consent — you don't enter them by hand.
</Note>

## Connect

Click **Connect** and complete the Microsoft admin-consent prompt. Microsoft Defender then appears under **Environment → Integrations**, and you can start asking the AI about your alerts and incidents in the Workspace.

<Note>
  Myrmex requests read-oriented Microsoft Graph permissions for triage. Consent can be revoked at any time from the Microsoft Entra admin center.
</Note>