--- title: "Microsoft Defender for Cloud MCP server - actionlake" description: "Give Claude 277 Microsoft Defender for Cloud actions through one MCP server: alerts. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/microsoft-defender-for-cloud updated: 2026-10-23 --- Connectors · MSP & PSA # Microsoft Defender for Cloud MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Microsoft Defender for Cloud and the rest of your systems. It gives your agent 277 Microsoft Defender for Cloud actions (178 reads, 68 writes and 31 that wait for a confirmation) and holds the Microsoft Defender for Cloud credential itself, so the agent never does. It paces Microsoft Defender for Cloud's limits and records every call. [Connect Microsoft Defender for Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "azure_defender_for_cloud.assessments_metadata.list", intent: "check which Microsoft Defender for Cloud account is connected" } # Get metadata information on all assessment types · read · 1 upstream call ``` - 277 actions in one signed file - 178 read look, never change - 68 write create and update - 31 wait for a yes destructive, confirmed first Set up ## Connect Microsoft Defender for Cloud in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Microsoft Defender for Cloud. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Entra application (client) id of a service principal with Security Reader or Security Admin on the subscription - `client_secret` Entra client secret - `tenant_id` Your Microsoft Defender for Cloud tenant id ``` account { op: "connections.requirements", service: "azure_defender_for_cloud" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "azure_defender_for_cloud.assessments_metadata.list" } # get metadata information on all assessment types · read · 1 upstream call check { action: "azure_defender_for_cloud.alerts.simulate", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Microsoft Defender for Cloud at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `tenant_id` **Limits we pace to** 200 calls a minute, per connection **API covered** Microsoft Defender for Cloud (secure score, recommendations, alerts, Defender plans, regulatory compliance, JIT, DevOps security) API Azure Resource Manager Microsoft.Security, one api-version per resource type: stable/2026-07-01/pricings.json (2026-07-01), stable/2026-07-01/batchPricings.json (2026-07-01), stable/2020-01-01/secureScore.json (2020-01-01), stable/2025-05-04/security-Assessment.json (2025-05-04), preview/2019-01-01-preview/subAssessments.json (2019-01-01-preview), stable/2022-01-01/alerts.json (2022-01-01), preview/2019-01-01-preview/alertsSuppressionRules.json (2019-01-01-preview), preview/2019-01-01-preview/regulatoryCompliance.json (2019-01-01-preview), stable/2024-08-01/security-SecurityStandards.json (2024-08-01), preview/2022-01-01-preview/security-Governance.json (2022-01-01-preview), stable/2020-01-01/security-SecuritySolutions.json (2020-01-01), preview/2015-06-01-preview/locations.json (2015-06-01-preview), preview/2015-06-01-preview/tasks.json (2015-06-01-preview), preview/2017-08-01-preview/security-LegacySettings.json (2017-08-01-preview), preview/2021-05-01-preview/softwareInventories.json (2021-05-01-preview), preview/2021-10-01-preview/mdeOnboardings.json (2021-10-01-preview), preview/2022-07-01-preview/applications.json (2022-07-01-preview), preview/2023-01-01-preview/securityOperators.json (2023-01-01-preview), preview/2026-04-01-preview/security-SqlVulnerabilityAssessments.json (2026-04-01-preview), preview/2023-02-15-preview/sensitivitySettings.json (2023-02-15-preview), preview/2023-05-01-preview/healthReports.json (2023-05-01-preview), preview/2023-12-01-preview/security-Automations.json (2023-12-01-preview), preview/2026-08-01-preview/securityConnectors.json (2026-08-01-preview), stable/2025-03-01/securityConnectorsDevOps.json (2025-03-01), stable/2025-06-01/defenderForStorageSettings.json (2025-06-01), stable/2025-06-01/operations.json (2025-06-01), stable/2017-08-01/complianceResults.json (2017-08-01), stable/2019-01-01/advancedThreatProtectionSettings.json (2019-01-01), stable/2019-08-01/security-IoTSecurity.json (2019-08-01), stable/2022-05-01/settings.json (2022-05-01), stable/2023-05-01/ServerVulnerabilityAssessmentsSettings.json (2023-05-01), stable/2023-11-15/apiCollections.json (2023-11-15), stable/2026-01-01/privateLinks.json (2026-01-01), stable/2026-08-01/datascanners.json (2026-08-01), preview/2026-09-01-preview/serviceEntitlements.json (2026-09-01-preview), preview/2026-09-16-preview/serviceEntitlementSettings.json (2026-09-16-preview)`management.azure.com` **Built from** Microsoft Defender for Cloud's documentation, read 23 October 2026[GitHub](https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security/) [learn.microsoft.com](https://learn.microsoft.com/en-us/rest/api/defenderforcloud/) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 173 of 178 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Microsoft Defender for Cloud up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Microsoft Defender for Cloud. 277 actions in 76 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **178** read look, never change - **68** write create and update - **31** destructive wait for a confirmation 1. ### Alerts 15 6 read · 9 write · 0 destructive List all the alerts that are associated with the subscription · Get an alert that is associated with a subscription · List all the alerts that are associated with the resource group · List all the alerts that are associated with the resource group that are stored in a specific location 2. ### Jit network access policies 8 5 read · 2 write · 1 destructive Policies for protecting resources using Just-in-Time access control · Policies for protecting resources using Just-in-Time access control for the subscription, location · Policies for protecting resources using Just-in-Time access control for the subscription, location · Policies for protecting resources using Just-in-Time access control for the subscription, location 3. ### Automations 7 4 read · 2 write · 1 destructive Lists all the security automations in the specified subscription · Lists all the security automations in the specified resource group · Retrieves information about the model of a security automation · Validates the security automation model before create or update 4. ### Service entitlements 7 4 read · 2 write · 1 destructive Lists service entitlements in a resource group · Lists service entitlements in a subscription · Gets a service entitlement · Gets the result of a long-running operation performed on a service entitlement 5. ### Tasks 7 5 read · 2 write · 0 destructive Recommended tasks that will help improve the security of the subscription proactively · Recommended tasks that will help improve the security of the subscription proactively · Recommended tasks that will help improve the security of the subscription proactively · Recommended tasks that will help improve the security of the subscription proactively 6. ### API collections 6 4 read · 1 write · 1 destructive Gets a list of onboarded Azure API Management APIs · Gets a list of API collections within a resource group · Gets a list of API collections within a subscription · Gets an onboarded Azure API Management API 7. ### Assessments metadata 6 4 read · 1 write · 1 destructive Get metadata information on all assessment types · Get metadata information on all assessment types in a specific subscription · Get metadata information on an assessment type · Get metadata information on an assessment type in a specific subscription 8. ### Governance rules 6 3 read · 2 write · 1 destructive Get a list of all relevant governance rules over a scope · Get a specific governance rule for the requested scope by ruleId · Get governance rules long run operation result for the requested scope by ruleId and operationId · Execute a governance rule **68 more areas · 215 actions** - Iot security solutions **6** - Private links **6** - Security connectors **6** - Service entitlement settings **6** - Azure devops orgs **5** - Defender for storage **5** - Devops configurations **5** - SQL vulnerability assessment baseline rules **5** - Workspace settings **5** - Alerts suppression rules **4** - Applications **4** - Assessments **4** - Azure devops projects **4** - Azure devops repos **4** - Custom recommendations **4** - Data scanners **4** - Device security groups **4** - Governance assignments **4** - Pricings **4** - Private endpoint connections **4** - Security connector applications **4** - Security contacts **4** - Security operators **4** - Security standards **4** - Server vulnerability assessments **4** - Server vulnerability assessments settings **4** - SQL vulnerability assessment scans **4** - Standard assignments **4** - Allowed connections **3** - Auto provisioning settings **3** - Batch pricings **3** - Discovered security solutions **3** - External security solutions **3** - Github owners **3** - Gitlab groups **3** - Information protection policies **3** - Iot security solutions analytics aggregated alert **3** - Sensitivity settings **3** - Settings **3** - Software inventories **3** - SQL vulnerability assessment settings **3** - Sub assessments **3** - Topologies **3** - Advanced threat protection **2** - Compliance results **2** - Compliances **2** - Github repos **2** - Gitlab projects **2** - Health reports **2** - Iot security solution analytics **2** - Iot security solutions analytics recommendation **2** - Locations **2** - Mde onboardings **2** - Private link resources **2** - Regulatory compliance assessments **2** - Regulatory compliance controls **2** - Regulatory compliance standards **2** - Secure score control definitions **2** - Secure score controls **2** - Secure scores **2** - Security solutions **2** - Security solutions reference data **2** - SQL vulnerability assessment scan results **2** - Devops operation results **1** - Gitlab subgroups **1** - Operations **1** - Resource groups **1** - Subscriptions **1** Top actions ## The Microsoft Defender for Cloud API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 8 of Microsoft Defender for Cloud's 8 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `azure_defender_for_cloud.governance_rules.list` Get a list of all relevant governance rules over a scope | Get a list of all relevant governance rules over a scope. | read | `security.policy.list` 36 connectors | | `azure_defender_for_cloud.alerts.list` List all the alerts that are associated with the subscription | List all the alerts that are associated with the subscription. | read | `security.alert.list` 22 connectors | | `azure_defender_for_cloud.alerts.get_subscription_level` Get an alert that is associated with a subscription | Get an alert that is associated with a subscription. | read | `security.alert.get` 21 connectors | | `azure_defender_for_cloud.secure_score_controls.list` Get all security controls within a scope | Get all security controls within a scope. | read | `security.control.list` 6 connectors | | `azure_defender_for_cloud.standard_assignments.list` Get a list of all relevant standard assignments over a scope | Get a list of all relevant standard assignments over a scope. | read | `security.policy_assignment.list` 5 connectors | | `azure_defender_for_cloud.regulatory_compliance_standards.list` Supported regulatory compliance standards details and state | Supported regulatory compliance standards details and state. | read | `security.framework.list` 5 connectors | | `azure_defender_for_cloud.resource_groups.list` List the resource groups in a subscription | List the resource groups in a subscription. | read | `infra.resource_group.list` 19 connectors | | `azure_defender_for_cloud.regulatory_compliance_standards.get` Supported regulatory compliance details state for selected standard | Supported regulatory compliance details state for selected standard. | read | `security.framework.get` 4 connectors | | `azure_defender_for_cloud.alerts.simulate` Simulate security alerts | Simulate security alerts. | write | this connector | | `azure_defender_for_cloud.jit_network_access_policies.initiate` Initiate a JIT access from a specific Just-in-Time policy configuration | Initiate a JIT access from a specific Just-in-Time policy configuration. | write | this connector | | `azure_defender_for_cloud.defender_for_storage.start_malware_scan` Initiate a Defender for Storage malware scan for the specified storage account | Initiate a Defender for Storage malware scan for the specified storage account. | write | this connector | | `azure_defender_for_cloud.pricings.delete` Deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource | Deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource. | destructive | this connector | Try it ## Prompts to paste into Claude. Each one names the Microsoft Defender for Cloud actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Microsoft Defender for Cloud alerts are open right now? Group them by service. calls `azure_defender_for_cloud.alerts.list` 2. Write write Simulate security alerts in Microsoft Defender for Cloud. Show me exactly what you will send before you save it. calls `azure_defender_for_cloud.alerts.simulate` Governance for Microsoft Defender for Cloud ## Destructive actions wait for a yes. 31 Microsoft Defender for Cloud actions are destructive. The first 10: - Deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource `azure_defender_for_cloud.pricings.delete` - Delete a security assessment on your resource `azure_defender_for_cloud.assessments.delete` - Deletes a security automation `azure_defender_for_cloud.automations.delete` - Delete an Application over a given scope `azure_defender_for_cloud.applications.delete` - Deletes a data scanner resource for the specified scope `azure_defender_for_cloud.data_scanners.delete` - Delete a private link resource `azure_defender_for_cloud.private_links.delete` - Delete a Governance rule over a given scope `azure_defender_for_cloud.governance_rules.delete` - Delete security contact configurations for the subscription `azure_defender_for_cloud.security_contacts.delete` - Delete Microsoft Defender for Cloud securityOperator in the subscription `azure_defender_for_cloud.security_operators.delete` - Delete a security standard over a given scope `azure_defender_for_cloud.security_standards.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do azure_defender_for_cloud.pricings.delete confirm_policy: **human** Deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource? **intent:** the user asked me to deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource run suspended · waiting for a named person · key _azure-defender-for-cloud-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "azure-defender-for-cloud-agent", allowed_actions: ["azure_defender_for_cloud.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "azure_defender_for_cloud.pricings.delete", approver: "lead@example.com" }, { match: "azure_defender_for_cloud.assessments.delete", approver: "lead@example.com" }, { match: "azure_defender_for_cloud.automations.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Microsoft Defender for Cloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Microsoft Defender for Cloud costs on actionlake. Every Microsoft Defender for Cloud action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Microsoft Defender for Cloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 277 Microsoft Defender for Cloud actions - 89 actions page each page of a long list is one call - 173 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Microsoft Defender for Cloud action. 277 actions by area: the id your agent calls, what it does, and its effect. **Alerts 15** - `azure_defender_for_cloud.alerts.get_subscription_level` Get an alert that is associated with a subscription read - `azure_defender_for_cloud.alerts.list` List all the alerts that are associated with the subscription read - and 13 more in this area **Jit network access policies 8** - `azure_defender_for_cloud.jit_network_access_policies.get` Policies for protecting resources using Just-in-Time access control for the subscription, location read - `azure_defender_for_cloud.jit_network_access_policies.list` Policies for protecting resources using Just-in-Time access control read - and 6 more in this area **Automations 7** - `azure_defender_for_cloud.automations.get` Retrieves information about the model of a security automation read - `azure_defender_for_cloud.automations.list` Lists all the security automations in the specified subscription read - and 5 more in this area **Service entitlements 7** - `azure_defender_for_cloud.service_entitlements.get` Gets a service entitlement read - `azure_defender_for_cloud.service_entitlements.get_operation_result` Gets the result of a long-running operation performed on a service entitlement read - and 5 more in this area **Tasks 7** - `azure_defender_for_cloud.tasks.get_resource_group_level_task` Recommended tasks that will help improve the security of the subscription proactively read - `azure_defender_for_cloud.tasks.get_subscription_level_task` Recommended tasks that will help improve the security of the subscription proactively read - and 5 more in this area **API collections 6** - `azure_defender_for_cloud.api_collections.get_by_azure_api_management_service` Gets an onboarded Azure API Management API read - `azure_defender_for_cloud.api_collections.list_by_azure_api_management_service` Gets a list of onboarded Azure API Management APIs read - and 4 more in this area **Assessments metadata 6** - `azure_defender_for_cloud.assessments_metadata.get` Get metadata information on an assessment type read - `azure_defender_for_cloud.assessments_metadata.get_in_subscription` Get metadata information on an assessment type in a specific subscription read - and 4 more in this area **Governance rules 6** - `azure_defender_for_cloud.governance_rules.execute` Execute a governance rule write - `azure_defender_for_cloud.governance_rules.get` Get a specific governance rule for the requested scope by ruleId read - and 4 more in this area **Iot security solutions 6** - `azure_defender_for_cloud.iot_security_solutions.get` User this method to get details of a specific IoT Security solution based on solution name read - `azure_defender_for_cloud.iot_security_solutions.list_by_resource_group` Use this method to get the list IoT Security solutions organized by resource group read - and 4 more in this area **Private links 6** - `azure_defender_for_cloud.private_links.get` Get a private link resource read - `azure_defender_for_cloud.private_links.list` Lists all the private links in the specified resource group read - and 4 more in this area **Security connectors 6** - `azure_defender_for_cloud.security_connectors.get` Retrieves details of a specific security connector read - `azure_defender_for_cloud.security_connectors.list` Lists all the security connectors in the specified subscription read - and 4 more in this area **Service entitlement settings 6** - `azure_defender_for_cloud.service_entitlement_settings.get` Gets a service entitlement setting read - `azure_defender_for_cloud.service_entitlement_settings.list_by_resource_group` Lists service entitlement settings in a resource group read - and 4 more in this area **Azure devops orgs 5** - `azure_defender_for_cloud.azure_devops_orgs.get` Returns a monitored Azure DevOps organization resource read - `azure_defender_for_cloud.azure_devops_orgs.list` Returns a list of Azure DevOps organizations onboarded to the connector read - and 3 more in this area **Defender for storage 5** - `azure_defender_for_cloud.defender_for_storage.cancel_malware_scan` Cancels a Defender for Storage malware scan for the specified storage account destructive - `azure_defender_for_cloud.defender_for_storage.get` Gets the Defender for Storage settings for the specified storage account read - and 3 more in this area **Devops configurations 5** - `azure_defender_for_cloud.devops_configurations.delete` Deletes a DevOps Connector destructive - `azure_defender_for_cloud.devops_configurations.get` Gets a DevOps Configuration read - and 3 more in this area **SQL vulnerability assessment baseline rules 5** - `azure_defender_for_cloud.sql_vulnerability_assessment_baseline_rules.add` Set a list of baseline rules. Will overwrite any previously existing results (for all rules) write - `azure_defender_for_cloud.sql_vulnerability_assessment_baseline_rules.delete` Deletes a rule from the Baseline of a given database destructive - and 3 more in this area **Workspace settings 5** - `azure_defender_for_cloud.workspace_settings.delete` Deletes the custom workspace settings for this subscription destructive - `azure_defender_for_cloud.workspace_settings.get` Settings about where we should store your security data and logs read - and 3 more in this area **Alerts suppression rules 4** - `azure_defender_for_cloud.alerts_suppression_rules.delete` Delete dismiss alert rule for this subscription destructive - `azure_defender_for_cloud.alerts_suppression_rules.get` Get dismiss rule, with name: {alertsSuppressionRuleName}, for the given subscription read - and 2 more in this area **Applications 4** - `azure_defender_for_cloud.applications.create_or_update` Creates or update a security application on the given subscription write - `azure_defender_for_cloud.applications.delete` Delete an Application over a given scope destructive - and 2 more in this area **Assessments 4** - `azure_defender_for_cloud.assessments.create_or_update` Create a security assessment on your resource write - `azure_defender_for_cloud.assessments.delete` Delete a security assessment on your resource destructive - and 2 more in this area **Azure devops projects 4** - `azure_defender_for_cloud.azure_devops_projects.create_or_update` Creates or updates a monitored Azure DevOps project resource write - `azure_defender_for_cloud.azure_devops_projects.get` Returns a monitored Azure DevOps project resource read - and 2 more in this area **Azure devops repos 4** - `azure_defender_for_cloud.azure_devops_repos.create_or_update` Creates or updates a monitored Azure DevOps repository resource write - `azure_defender_for_cloud.azure_devops_repos.get` Returns a monitored Azure DevOps repository resource read - and 2 more in this area **Custom recommendations 4** - `azure_defender_for_cloud.custom_recommendations.create_or_update` Creates or updates a custom recommendation over a given scope write - `azure_defender_for_cloud.custom_recommendations.delete` Delete a custom recommendation over a given scope destructive - and 2 more in this area **Data scanners 4** - `azure_defender_for_cloud.data_scanners.create_or_update` Creates or updates a data scanner resource for the specified scope write - `azure_defender_for_cloud.data_scanners.delete` Deletes a data scanner resource for the specified scope destructive - and 2 more in this area **Device security groups 4** - `azure_defender_for_cloud.device_security_groups.create_or_update` Use this method to creates or updates the device security group on a specified IoT Hub resource write - `azure_defender_for_cloud.device_security_groups.delete` User this method to deletes the device security group destructive - and 2 more in this area **Governance assignments 4** - `azure_defender_for_cloud.governance_assignments.create_or_update` Creates or updates a governance assignment on the given subscription write - `azure_defender_for_cloud.governance_assignments.delete` Delete a GovernanceAssignment over a given scope destructive - and 2 more in this area **Pricings 4** - `azure_defender_for_cloud.pricings.delete` Deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource destructive - `azure_defender_for_cloud.pricings.get` Get the Defender plans pricing configurations of the selected scope (valid scopes are resource id or a subscription id) read - and 2 more in this area **Private endpoint connections 4** - `azure_defender_for_cloud.private_endpoint_connections.create_or_update` Update the state of specified private endpoint connection associated with the private link write - `azure_defender_for_cloud.private_endpoint_connections.delete` Deletes the specified private endpoint connection associated with the private link destructive - and 2 more in this area **Security connector applications 4** - `azure_defender_for_cloud.security_connector_applications.create_or_update` Creates or update a security Application on the given security connector write - `azure_defender_for_cloud.security_connector_applications.delete` Delete an Application over a given scope destructive - and 2 more in this area **Security contacts 4** - `azure_defender_for_cloud.security_contacts.create` Create security contact configurations for the subscription write - `azure_defender_for_cloud.security_contacts.delete` Delete security contact configurations for the subscription destructive - and 2 more in this area Security operators **4** Security standards **4** Server vulnerability assessments **4** Server vulnerability assessments settings **4** SQL vulnerability assessment scans **4** Standard assignments **4** Allowed connections **3** Auto provisioning settings **3** Batch pricings **3** Discovered security solutions **3** External security solutions **3** Github owners **3** Gitlab groups **3** Information protection policies **3** Iot security solutions analytics aggregated alert **3** Sensitivity settings **3** Settings **3** Software inventories **3** SQL vulnerability assessment settings **3** Sub assessments **3** Topologies **3** Advanced threat protection **2** Compliance results **2** Compliances **2** Github repos **2** Gitlab projects **2** Health reports **2** Iot security solution analytics **2** Iot security solutions analytics recommendation **2** Locations **2** Mde onboardings **2** Private link resources **2** Regulatory compliance assessments **2** Regulatory compliance controls **2** Regulatory compliance standards **2** Secure score control definitions **2** Secure score controls **2** Secure scores **2** Security solutions **2** Security solutions reference data **2** SQL vulnerability assessment scan results **2** Devops operation results **1** Gitlab subgroups **1** Operations **1** Resource groups **1** Subscriptions **1** This index shows a sample of each area. All 277 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Microsoft Defender for Cloud MCP server, answered. **Is there a Microsoft Defender for Cloud MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 277 Microsoft Defender for Cloud actions across alerts, jit network access policies, automations and service entitlements, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Microsoft Defender for Cloud. **What do I need to connect Microsoft Defender for Cloud?** Entra application (client) id of a service principal with Security Reader or Security Admin on the subscription and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "azure_defender_for_cloud" } lists exactly what to paste. **Can an AI agent delete or change things in Microsoft Defender for Cloud?** Only if its key allows it, and only with an explicit confirmation. 31 Microsoft Defender for Cloud actions are destructive, including deletes a provided Microsoft Defender for Cloud pricing configuration in a specific resource, delete a security assessment on your resource and deletes a security automation. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Microsoft Defender for Cloud API limit?** actionlake paces every call to the limits in the Microsoft Defender for Cloud service file: 200 calls a minute per connection. Repeated reads are answered from cache (173 Microsoft Defender for Cloud actions can be), which never reaches Microsoft Defender for Cloud. **What does a Microsoft Defender for Cloud action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (89 Microsoft Defender for Cloud actions page). Cache hits, searches, dry runs and calls Microsoft Defender for Cloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Microsoft Defender for Cloud API does it cover?** The Microsoft Defender for Cloud (secure score, recommendations, alerts, Defender plans, regulatory compliance, JIT, DevOps security) API Azure Resource Manager Microsoft.Security, one api-version per resource type: stable/2026-07-01/pricings.json (2026-07-01), stable/2026-07-01/batchPricings.json (2026-07-01), stable/2020-01-01/secureScore.json (2020-01-01), stable/2025-05-04/security-Assessment.json (2025-05-04), preview/2019-01-01-preview/subAssessments.json (2019-01-01-preview), stable/2022-01-01/alerts.json (2022-01-01), preview/2019-01-01-preview/alertsSuppressionRules.json (2019-01-01-preview), preview/2019-01-01-preview/regulatoryCompliance.json (2019-01-01-preview), stable/2024-08-01/security-SecurityStandards.json (2024-08-01), preview/2022-01-01-preview/security-Governance.json (2022-01-01-preview), stable/2020-01-01/security-SecuritySolutions.json (2020-01-01), preview/2015-06-01-preview/locations.json (2015-06-01-preview), preview/2015-06-01-preview/tasks.json (2015-06-01-preview), preview/2017-08-01-preview/security-LegacySettings.json (2017-08-01-preview), preview/2021-05-01-preview/softwareInventories.json (2021-05-01-preview), preview/2021-10-01-preview/mdeOnboardings.json (2021-10-01-preview), preview/2022-07-01-preview/applications.json (2022-07-01-preview), preview/2023-01-01-preview/securityOperators.json (2023-01-01-preview), preview/2026-04-01-preview/security-SqlVulnerabilityAssessments.json (2026-04-01-preview), preview/2023-02-15-preview/sensitivitySettings.json (2023-02-15-preview), preview/2023-05-01-preview/healthReports.json (2023-05-01-preview), preview/2023-12-01-preview/security-Automations.json (2023-12-01-preview), preview/2026-08-01-preview/securityConnectors.json (2026-08-01-preview), stable/2025-03-01/securityConnectorsDevOps.json (2025-03-01), stable/2025-06-01/defenderForStorageSettings.json (2025-06-01), stable/2025-06-01/operations.json (2025-06-01), stable/2017-08-01/complianceResults.json (2017-08-01), stable/2019-01-01/advancedThreatProtectionSettings.json (2019-01-01), stable/2019-08-01/security-IoTSecurity.json (2019-08-01), stable/2022-05-01/settings.json (2022-05-01), stable/2023-05-01/ServerVulnerabilityAssessmentsSettings.json (2023-05-01), stable/2023-11-15/apiCollections.json (2023-11-15), stable/2026-01-01/privateLinks.json (2026-01-01), stable/2026-08-01/datascanners.json (2026-08-01), preview/2026-09-01-preview/serviceEntitlements.json (2026-09-01-preview), preview/2026-09-16-preview/serviceEntitlementSettings.json (2026-09-16-preview) at management.azure.com. It is built from Microsoft Defender for Cloud's documentation as read on 23 October 2026. 277 actions in 76 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Microsoft Defender for Cloud data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Microsoft Defender for Cloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Microsoft Defender for Cloud Shares the most action names with - [ESET Connect 4](https://actionlake.com/connectors/eset-connect) - [Blumira 2](https://actionlake.com/connectors/blumira) - [SonicWall SonicOS 1](https://actionlake.com/connectors/sonicwall-sonicos) - [Fortinet FortiGate 1](https://actionlake.com/connectors/fortinet-fortigate) - [Azure Storage 1](https://actionlake.com/connectors/azure-storage) - [Azure Kubernetes Service (AKS) 1](https://actionlake.com/connectors/azure-kubernetes-service-aks) Joins with, on shared entities - [Google Security Command Center 2](https://actionlake.com/connectors/google-security-command-center) - [Socket 2](https://actionlake.com/connectors/socket) - [Panther 2](https://actionlake.com/connectors/panther) - [Cloudflare 1](https://actionlake.com/connectors/cloudflare) - [CrowdStrike Falcon 1](https://actionlake.com/connectors/crowdstrike-falcon) - [HashiCorp Vault 1](https://actionlake.com/connectors/hashicorp-vault) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Microsoft Defender for Cloud; the name is the vendor's own. Counts are from the Microsoft Defender for Cloud service file, version 1.0.0. ## Give your agent Microsoft Defender for Cloud today. [Connect Microsoft Defender for Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/microsoft-defender-for-cloud More: https://actionlake.com/llms.txt