Skip to main content

Hi Team,

I have a few questions:

  1. Does the current 'Microsoft 365 Defender' integration package include the Defender for Identity solution?
  2. What are the differences between the 'Microsoft 365 Defender' and 'Defender ATP' integration packages in terms of the Defender solutions they aim to integrate?
  3. Can we use the same app registration for both of these integrations?

 


Defender for Identity is not directly integrated here but there are Azure components that are well suited to do the same/similar thing.  


The differences are defined in the details sections of each integration.   The ATP component is more dialed int the endpoint mgmt.   You can use the same app registration for both.  



Hey @VictorSOAR,


Additionally to what @dnehoda said. Microsoft 365 Defender integration main use case is in the ingestion. It allows you to ingest Incidents/Alerts from all sources that feed into Microsoft 365 Defender ecosystem.


We don't have a dedicated integration for Microsoft Defender For Identity, yet. But if you have some use cases around it, then you can use HTTPV2 integration to get data out of it. Here is the guide that you can use.


Thanks @dnehoda , @ylandovskyy  for your response, appreciated!


Reply