--- title: "Microsoft Defender for Endpoint MCP server - actionlake" description: "Give Claude 110 Microsoft Defender for Endpoint actions through one MCP server: assessments. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/microsoft-defender-for-endpoint updated: 2026-10-22 --- Connectors · Identity & security # Microsoft Defender for Endpoint MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Microsoft Defender for Endpoint and the rest of your systems. It gives your agent 110 Microsoft Defender for Endpoint actions (84 reads, 20 writes and 6 that wait for a confirmation) and holds the Microsoft Defender for Endpoint credential itself, so the agent never does. It paces Microsoft Defender for Endpoint's limits and records every call. [Connect Microsoft Defender for Endpoint free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "microsoft_defender_endpoint.machines.list", intent: "check which Microsoft Defender for Endpoint account is connected" } # List machines · read · 1 upstream call ``` - 110 actions in one signed file - 84 read look, never change - 20 write create and update - 6 wait for a yes destructive, confirmed first Set up ## Connect Microsoft Defender for Endpoint in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Microsoft Defender for Endpoint. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Entra application (client) id - `client_secret` Entra client secret - `tenant_id` Your Microsoft Defender for Endpoint tenant id ``` account { op: "connections.requirements", service: "microsoft_defender_endpoint" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "microsoft_defender_endpoint.machines.list" } # list machines · read · 1 upstream call check { action: "microsoft_defender_endpoint.machines.update", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Microsoft Defender for Endpoint at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `tenant_id` **Limits we pace to** 100 calls a minute and 1,500 an hour, per connection **API covered** Defender for Endpoint API v1.0 (api.security.microsoft.com/api)`api.security.microsoft.com/api` **Built from** Microsoft Defender for Endpoint's documentation, read 22 October 2026[learn.microsoft.com](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 84 of 84 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Microsoft Defender for Endpoint up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Microsoft Defender for Endpoint. 110 actions in 52 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **84** read look, never change - **20** write create and update - **6** destructive wait for a confirmation 1. ### Assessments 16 16 read · 0 write · 0 destructive Export security baselines assessment per device (JSON) · Export browser extensions assessment per device (JSON) · Export certificate inventory assessment per device (JSON) · Export non-product-code software inventory per device (JSON) 2. ### Machine response 10 0 read · 9 write · 1 destructive Collect an investigation package · Isolate a machine from the network · Restrict app execution on a machine · Run a Microsoft Defender Antivirus scan 3. ### Machines 7 5 read · 2 write · 0 destructive List machines · Get a machine · Update a machine's tags and value · Find a device by internal IP 4. ### Alerts 5 2 read · 3 write · 0 destructive List alerts · Get an alert · Create an alert from an event · Update an alert 5. ### Indicators 5 1 read · 2 write · 2 destructive List indicators · Delete indicators in bulk · Delete an indicator · Import indicators in bulk 6. ### Machine actions 5 4 read · 0 write · 1 destructive List machine actions · Get a machine action · Cancel a pending machine action · Get a live response command result link 7. ### Scan definitions 4 1 read · 2 write · 1 destructive Create an authenticated scan definition · List authenticated scan definitions · Update an authenticated scan definition · Delete authenticated scan definitions 8. ### Scores 3 3 read · 0 write · 0 destructive List exposure scores by device group · Get the device secure score · Get the organization exposure score **44 more areas · 55 actions** - Vulnerabilities **3** - Baselines **2** - Investigations **2** - Library files **2** - Machine tags **2** - Recommendations **2** - Remediation tasks **2** - Scan agents **2** - Scan history **2** - Software **2** - Advanced queries **1** - Alert domains **1** - Alert files **1** - Alert ips **1** - Alert machine **1** - Alert user **1** - Browser extensions **1** - Device health **1** - Domain alerts **1** - Domain machines **1** - Domain stats **1** - File alerts **1** - File machines **1** - File stats **1** - Files **1** - Ip alerts **1** - Ip stats **1** - Machine alerts **1** - Machine logon users **1** - Machine missing KBS **1** - Machine recommendations **1** - Machine software **1** - Machine vulnerabilities **1** - Recommendation machines **1** - Recommendation software **1** - Recommendation vulnerabilities **1** - Remediation task machines **1** - Software distributions **1** - Software machines **1** - Software missing KBS **1** - Software vulnerabilities **1** - User alerts **1** - User machines **1** - Vulnerability machines **1** Top actions ## The Microsoft Defender for Endpoint API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 13 of Microsoft Defender for Endpoint's 14 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `microsoft_defender_endpoint.machines.list` List machines | List onboarded devices with health, risk and exposure. | read | `device.endpoint.list` 65 connectors | | `microsoft_defender_endpoint.machines.get` Get a machine | Get a machine. | read | `device.endpoint.get` 57 connectors | | `microsoft_defender_endpoint.machines.update` Update a machine's tags and value | Update a machine's tags and value. | write | `device.endpoint.update` 23 connectors | | `microsoft_defender_endpoint.alerts.list` List alerts | List Defender for Endpoint alerts, optionally filtered by OData. | read | `security.alert.list` 22 connectors | | `microsoft_defender_endpoint.machine_actions.list` List machine actions | List machine actions. | read | `device.remote_command.list` 4 connectors | | `microsoft_defender_endpoint.alerts.get` Get an alert | Get an alert. | read | `security.alert.get` 21 connectors | | `microsoft_defender_endpoint.software.list` List software inventory | List software inventory. | read | `device.software.list` 11 connectors | | `microsoft_defender_endpoint.alerts.create_by_reference` Create an alert from an event | Create an alert from an event. | write | `security.alert.create` 5 connectors | | `microsoft_defender_endpoint.machine_actions.get` Get a machine action | Get a machine action. | read | `device.remote_command.get` 3 connectors | | `microsoft_defender_endpoint.vulnerabilities.list` List vulnerabilities | List vulnerabilities. | read | `security.vulnerability.list` 14 connectors | | `microsoft_defender_endpoint.machine_actions.cancel` Cancel a pending machine action | Cancel a pending machine action. | destructive | `device.remote_command.cancel` 2 connectors | | `microsoft_defender_endpoint.machines.isolate` Isolate a machine from the network | Isolate a machine from the network. | write | this connector | Try it ## Prompts to paste into Claude. Each one names the Microsoft Defender for Endpoint actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Microsoft Defender for Endpoint alerts are open right now? Group them by service. calls `microsoft_defender_endpoint.alerts.list` 2. Write write Update a machine's tags and value in Microsoft Defender for Endpoint. Show me exactly what you will send before you save it. calls `microsoft_defender_endpoint.machines.update` Governance for Microsoft Defender for Endpoint ## Destructive actions wait for a yes. 6 Microsoft Defender for Endpoint actions are destructive. These are all of them: - Cancel a pending machine action `microsoft_defender_endpoint.machine_actions.cancel` - Delete an indicator `microsoft_defender_endpoint.indicators.delete` - Offboard a machine `microsoft_defender_endpoint.machines.offboard` - Delete indicators in bulk `microsoft_defender_endpoint.indicators.batch_delete` - Delete a live response library file `microsoft_defender_endpoint.library_files.delete` - Delete authenticated scan definitions `microsoft_defender_endpoint.scan_definitions.batch_delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do microsoft_defender_endpoint.machine_actions.cancel confirm_policy: **human** Cancel a pending machine action? **intent:** the user asked me to cancel a pending machine action run suspended · waiting for a named person · key _microsoft-defender-endpoint-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "microsoft-defender-endpoint-agent", allowed_actions: ["microsoft_defender_endpoint.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "microsoft_defender_endpoint.machine_actions.cancel", approver: "lead@example.com" }, { match: "microsoft_defender_endpoint.indicators.delete", approver: "lead@example.com" }, { match: "microsoft_defender_endpoint.machines.offboard", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Microsoft Defender for Endpoint only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Microsoft Defender for Endpoint costs on actionlake. Every Microsoft Defender for Endpoint action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Microsoft Defender for Endpoint refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 110 Microsoft Defender for Endpoint actions - 110 actions page each page of a long list is one call - 84 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Microsoft Defender for Endpoint action. 110 actions by area: the id your agent calls, what it does, and its effect. **Assessments 16** - `microsoft_defender_endpoint.assessments.baseline_compliance.by_machine` Export security baselines assessment per device (JSON) read - `microsoft_defender_endpoint.assessments.baseline_compliance.export` Export security baselines assessment per device (download files) read - `microsoft_defender_endpoint.assessments.browser_extensions.by_machine` Export browser extensions assessment per device (JSON) read - `microsoft_defender_endpoint.assessments.browser_extensions.export` Export browser extensions assessment per device (download files) read - `microsoft_defender_endpoint.assessments.certificates.by_machine` Export certificate inventory assessment per device (JSON) read - `microsoft_defender_endpoint.assessments.certificates.export` Export certificate inventory assessment per device (download files) read - `microsoft_defender_endpoint.assessments.information_gathering.export` Export information gathering assessment (download files) read - `microsoft_defender_endpoint.assessments.non_cpe_software_inventory.by_machine` Export non-product-code software inventory per device (JSON) read - `microsoft_defender_endpoint.assessments.non_cpe_software_inventory.export` Export non-product-code software inventory per device (download files) read - `microsoft_defender_endpoint.assessments.secure_config.by_machine` Export secure configuration assessment per device (JSON) read - `microsoft_defender_endpoint.assessments.secure_config.export` Export secure configuration assessment per device (download files) read - `microsoft_defender_endpoint.assessments.software_inventory.by_machine` Export software inventory assessment per device (JSON) read - `microsoft_defender_endpoint.assessments.software_inventory.export` Export software inventory assessment per device (download files) read - `microsoft_defender_endpoint.assessments.software_vulnerabilities.by_machine` Export software vulnerabilities assessment per device (JSON) read - `microsoft_defender_endpoint.assessments.software_vulnerabilities.export` Export software vulnerabilities assessment per device (download files) read - `microsoft_defender_endpoint.assessments.software_vulnerability_changes.by_machine` Export software vulnerability changes per device since a time (JSON) read **Machine response 10** - `microsoft_defender_endpoint.machines.collect_investigation_package` Collect an investigation package write - `microsoft_defender_endpoint.machines.isolate` Isolate a machine from the network write - `microsoft_defender_endpoint.machines.offboard` Offboard a machine destructive - `microsoft_defender_endpoint.machines.restrict_code_execution` Restrict app execution on a machine write - `microsoft_defender_endpoint.machines.run_antivirus_scan` Run a Microsoft Defender Antivirus scan write - `microsoft_defender_endpoint.machines.run_live_response` Run live response commands on a machine write - `microsoft_defender_endpoint.machines.start_investigation` Start an automated investigation on a machine write - `microsoft_defender_endpoint.machines.stop_and_quarantine_file` Stop and quarantine a file on a machine write - `microsoft_defender_endpoint.machines.unisolate` Release a machine from isolation write - `microsoft_defender_endpoint.machines.unrestrict_code_execution` Remove app execution restriction write **Machines 7** - `microsoft_defender_endpoint.machines.find_by_internal_ip` Find a device by internal IP read - `microsoft_defender_endpoint.machines.find_by_ip` Find machines seen with an IP address read - `microsoft_defender_endpoint.machines.find_by_tag` Find machines by tag read - `microsoft_defender_endpoint.machines.get` Get a machine read - `microsoft_defender_endpoint.machines.list` List machines read - `microsoft_defender_endpoint.machines.set_device_value` Set a machine's device value write - `microsoft_defender_endpoint.machines.update` Update a machine's tags and value write **Alerts 5** - `microsoft_defender_endpoint.alerts.batch_update` Batch update alerts write - `microsoft_defender_endpoint.alerts.create_by_reference` Create an alert from an event write - `microsoft_defender_endpoint.alerts.get` Get an alert read - `microsoft_defender_endpoint.alerts.list` List alerts read - `microsoft_defender_endpoint.alerts.update` Update an alert write **Indicators 5** - `microsoft_defender_endpoint.indicators.batch_delete` Delete indicators in bulk destructive - `microsoft_defender_endpoint.indicators.delete` Delete an indicator destructive - `microsoft_defender_endpoint.indicators.import` Import indicators in bulk write - `microsoft_defender_endpoint.indicators.list` List indicators read - `microsoft_defender_endpoint.indicators.submit` Submit or update an indicator write **Machine actions 5** - `microsoft_defender_endpoint.machine_actions.cancel` Cancel a pending machine action destructive - `microsoft_defender_endpoint.machine_actions.get` Get a machine action read - `microsoft_defender_endpoint.machine_actions.get_live_response_result` Get a live response command result link read - `microsoft_defender_endpoint.machine_actions.get_package_uri` Get the investigation package download URI read - `microsoft_defender_endpoint.machine_actions.list` List machine actions read **Scan definitions 4** - `microsoft_defender_endpoint.scan_definitions.batch_delete` Delete authenticated scan definitions destructive - `microsoft_defender_endpoint.scan_definitions.create` Create an authenticated scan definition write - `microsoft_defender_endpoint.scan_definitions.list` List authenticated scan definitions read - `microsoft_defender_endpoint.scan_definitions.update` Update an authenticated scan definition write **Scores 3** - `microsoft_defender_endpoint.configuration_score.get` Get the device secure score read - `microsoft_defender_endpoint.exposure_score.by_machine_groups.list` List exposure scores by device group read - `microsoft_defender_endpoint.exposure_score.get` Get the organization exposure score read **Vulnerabilities 3** - `microsoft_defender_endpoint.vulnerabilities.by_machine_and_software.list` List vulnerabilities by machine and software read - `microsoft_defender_endpoint.vulnerabilities.get` Get a vulnerability read - `microsoft_defender_endpoint.vulnerabilities.list` List vulnerabilities read **Baselines 2** - `microsoft_defender_endpoint.baseline_configurations.list` List security baseline configurations read - `microsoft_defender_endpoint.baseline_profiles.list` List security baseline assessment profiles read **Investigations 2** - `microsoft_defender_endpoint.investigations.get` Get an automated investigation read - `microsoft_defender_endpoint.investigations.list` List automated investigations read **Library files 2** - `microsoft_defender_endpoint.library_files.delete` Delete a live response library file destructive - `microsoft_defender_endpoint.library_files.list` List live response library files read **Machine tags 2** - `microsoft_defender_endpoint.machines.tags.bulk_update` Add or remove a tag on multiple machines write - `microsoft_defender_endpoint.machines.tags.update` Add or remove a machine tag write **Recommendations 2** - `microsoft_defender_endpoint.recommendations.get` Get a security recommendation read - `microsoft_defender_endpoint.recommendations.list` List security recommendations read **Remediation tasks 2** - `microsoft_defender_endpoint.remediation_tasks.get` Get a remediation activity read - `microsoft_defender_endpoint.remediation_tasks.list` List remediation activities read **Scan agents 2** - `microsoft_defender_endpoint.scan_agents.get` Get an authenticated scan agent read - `microsoft_defender_endpoint.scan_agents.list` List authenticated scan agents read **Scan history 2** - `microsoft_defender_endpoint.scan_definitions.history_by_definition` Get scan history by scan definition read - `microsoft_defender_endpoint.scan_definitions.history_by_session` Get scan history by scan session read **Software 2** - `microsoft_defender_endpoint.software.get` Get a software product read - `microsoft_defender_endpoint.software.list` List software inventory read **Advanced queries 1** - `microsoft_defender_endpoint.advanced_queries.run` Run an advanced hunting query read **Alert domains 1** - `microsoft_defender_endpoint.alerts.domains.list` List domains related to an alert read **Alert files 1** - `microsoft_defender_endpoint.alerts.files.list` List files related to an alert read **Alert ips 1** - `microsoft_defender_endpoint.alerts.ips.list` List IP addresses related to an alert read **Alert machine 1** - `microsoft_defender_endpoint.alerts.machine.get` Get the device related to an alert read **Alert user 1** - `microsoft_defender_endpoint.alerts.user.get` Get the user related to an alert read **Browser extensions 1** - `microsoft_defender_endpoint.browser_extensions.permissions.list` List browser extension permission information read **Device health 1** - `microsoft_defender_endpoint.device_av_info.list` Export device antivirus health (JSON) read **Domain alerts 1** - `microsoft_defender_endpoint.domains.alerts.list` List alerts related to a domain read **Domain machines 1** - `microsoft_defender_endpoint.domains.machines.list` List machines that communicated with a domain read **Domain stats 1** - `microsoft_defender_endpoint.domains.stats.get` Get domain statistics read **File alerts 1** - `microsoft_defender_endpoint.files.alerts.list` List alerts related to a file read **File machines 1** - `microsoft_defender_endpoint.files.machines.list` List machines related to a file read **File stats 1** - `microsoft_defender_endpoint.files.stats.get` Get file statistics read **Files 1** - `microsoft_defender_endpoint.files.get` Get file information read **Ip alerts 1** - `microsoft_defender_endpoint.ips.alerts.list` List alerts related to an IP address read **Ip stats 1** - `microsoft_defender_endpoint.ips.stats.get` Get IP address statistics read **Machine alerts 1** - `microsoft_defender_endpoint.machines.alerts.list` List alerts on a machine read **Machine logon users 1** - `microsoft_defender_endpoint.machines.logon_users.list` List users who logged on to a machine read **Machine missing KBS 1** - `microsoft_defender_endpoint.machines.missing_kbs.list` List KBs missing on a machine read **Machine recommendations 1** - `microsoft_defender_endpoint.machines.recommendations.list` List security recommendations for a machine read **Machine software 1** - `microsoft_defender_endpoint.machines.software.list` List software installed on a machine read **Machine vulnerabilities 1** - `microsoft_defender_endpoint.machines.vulnerabilities.list` List vulnerabilities discovered on a machine read **Recommendation machines 1** - `microsoft_defender_endpoint.recommendations.machines.list` List machines exposed by a recommendation read **Recommendation software 1** - `microsoft_defender_endpoint.recommendations.software.get` Get the software a recommendation applies to read **Recommendation vulnerabilities 1** - `microsoft_defender_endpoint.recommendations.vulnerabilities.list` List vulnerabilities a recommendation addresses read **Remediation task machines 1** - `microsoft_defender_endpoint.remediation_tasks.machines.list` List devices exposed in a remediation activity read **Software distributions 1** - `microsoft_defender_endpoint.software.distributions.list` List software version distribution read **Software machines 1** - `microsoft_defender_endpoint.software.machines.list` List machines with a software product read **Software missing KBS 1** - `microsoft_defender_endpoint.software.missing_kbs.list` List KBs missing for a software product read **Software vulnerabilities 1** - `microsoft_defender_endpoint.software.vulnerabilities.list` List vulnerabilities in a software product read **User alerts 1** - `microsoft_defender_endpoint.users.alerts.list` List alerts related to a user read **User machines 1** - `microsoft_defender_endpoint.users.machines.list` List machines related to a user read **Vulnerability machines 1** - `microsoft_defender_endpoint.vulnerabilities.machines.list` List machines exposed to a vulnerability read Questions ## The Microsoft Defender for Endpoint MCP server, answered. **Is there a Microsoft Defender for Endpoint MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 110 Microsoft Defender for Endpoint actions across assessments, machine response, machines and alerts, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Microsoft Defender for Endpoint. **What do I need to connect Microsoft Defender for Endpoint?** Entra application (client) id and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "microsoft_defender_endpoint" } lists exactly what to paste. **Can an AI agent delete or change things in Microsoft Defender for Endpoint?** Only if its key allows it, and only with an explicit confirmation. 6 Microsoft Defender for Endpoint actions are destructive, including cancel a pending machine action, delete an indicator and offboard a machine. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Microsoft Defender for Endpoint API limit?** actionlake paces every call to the limits in the Microsoft Defender for Endpoint service file: 100 calls a minute and 1,500 an hour per connection. Repeated reads are answered from cache (84 Microsoft Defender for Endpoint actions can be), which never reaches Microsoft Defender for Endpoint. **What does a Microsoft Defender for Endpoint action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (110 Microsoft Defender for Endpoint actions page). Cache hits, searches, dry runs and calls Microsoft Defender for Endpoint refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Microsoft Defender for Endpoint API does it cover?** The Defender for Endpoint API v1.0 (api.security.microsoft.com/api) at api.security.microsoft.com/api. It is built from Microsoft Defender for Endpoint's documentation as read on 22 October 2026. 110 actions in 52 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Microsoft Defender for Endpoint data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Microsoft Defender for Endpoint credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Microsoft Defender for Endpoint Shares the most action names with - [Trend Vision One 6](https://actionlake.com/connectors/trend-vision-one) - [Microsoft Graph Security (Defender XDR) 5](https://actionlake.com/connectors/microsoft-graph-security-defender-xdr) - [LimaCharlie 4](https://actionlake.com/connectors/limacharlie) - [Expel Workbench 4](https://actionlake.com/connectors/expel-workbench) - [Qualys VMDR 3](https://actionlake.com/connectors/qualys-vmdr) - [Microsoft Intune 2](https://actionlake.com/connectors/microsoft-intune) Joins with, on shared entities - [NinjaOne 2](https://actionlake.com/connectors/ninjaone) - [Commvault Cloud 2](https://actionlake.com/connectors/commvault-cloud) - [HPE Aruba Networking Central 2](https://actionlake.com/connectors/hpe-aruba-networking-central) - [Veeam Service Provider Console 2](https://actionlake.com/connectors/veeam-service-provider-console) - [Dynatrace 2](https://actionlake.com/connectors/dynatrace) - [Sophos Central 2](https://actionlake.com/connectors/sophos-central) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Microsoft Defender for Endpoint; the name is the vendor's own. Counts are from the Microsoft Defender for Endpoint service file, version 1.0.0. ## Give your agent Microsoft Defender for Endpoint today. [Connect Microsoft Defender for Endpoint free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/microsoft-defender-for-endpoint More: https://actionlake.com/llms.txt