Access the Microsoft Defender for Endpoint APIs

Important

Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

Defender for Endpoint exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Defender for Endpoint capabilities. The API access requires OAuth2.0 authentication. For more information, see OAuth 2.0 Authorization Code Flow.

Watch this video for a quick overview of Defender for Endpoint's APIs.

In general, you’ll need to take the following steps to use the APIs:

  • Create an AAD application
  • Get an access token using this application
  • Use the token to access Defender for Endpoint API

You can access Defender for Endpoint API with Application Context or User Context.

  • Application Context: (Recommended)
    Used by apps that run without a signed-in user present. for example, apps that run as background services or daemons.

    Steps that need to be taken to access Defender for Endpoint API with application context:

    1. Create an AAD Web-Application.

    2. Assign the desired permission to the application, for example, 'Read Alerts', 'Isolate Machines'.

    3. Create a key for this Application.

    4. Get token using the application with its key.

    5. Use the token to access Microsoft Defender ATP API

      For more information, see Get access with application context.

  • User Context:
    Used to perform actions in the API on behalf of a user.

    Steps to take to access Defender for Endpoint API with application context:

    1. Create AAD Native-Application.

    2. Assign the desired permission to the application, e.g 'Read Alerts', 'Isolate Machines' etc.

    3. Get token using the application with user credentials.

    4. Use the token to access Microsoft Defender ATP API

      For more information, see Get access with user context.