Skip to content

docs: Microsoft Defender connector setup guide#15156

Open
devGregA wants to merge 1 commit into
DefectDojo:devfrom
devGregA:sc-13448_defender_docs
Open

docs: Microsoft Defender connector setup guide#15156
devGregA wants to merge 1 commit into
DefectDojo:devfrom
devGregA:sc-13448_defender_docs

Conversation

@devGregA

@devGregA devGregA commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds the Microsoft Defender section to the Connectors tool reference (docs/content/import_data/pro/connectors/connectors_tool_reference.md), documenting the new MDVM findings connector.

Covers:

  • What the connector imports (device × software version × CVE findings from Defender Vulnerability Management) and how device groups map to Records
  • License prerequisites, including the easy-to-hit trap that the MDVM Add-on SKU does nothing without Defender for Endpoint P2 (use Standalone for evaluation)
  • Step-by-step Entra app registration: Application (not Delegated) Vulnerability.Read.All + the required Grant admin consent click — the two most common setup failures, both verified against a live tenant
  • Connector field mappings (Location / Tenant ID / Client ID / Client Secret / Minimum Severity)
  • Expected data timing: ~6-hour snapshot refresh, up to ~24h for newly onboarded devices, ~20-minute license-activation propagation
  • Disambiguation from the existing file-based "MSDefender Parser" scan type

Pairs with the connector implementation in DefectDojo-Inc/connectors#652 and the Pro registration in DefectDojo-Inc/dojo-pro#1753 (story sc-13448). Every gotcha documented here was reproduced or hit for real while validating the connector against a live MDVM trial tenant.

🤖 Generated with Claude Code

Adds the Microsoft Defender (MDVM) section to the Connectors tool
reference: license prerequisites (incl. the Standalone-vs-Add-on SKU
trap), Entra app registration walkthrough (Application permission +
admin consent gotchas), connector field mappings, device-group Record
model, and expected data timing (6h snapshot cycle, ~24h for new
devices, ~20min license propagation).

Pairs with DefectDojo-Inc/connectors#652 and DefectDojo-Inc/dojo-pro#1753
(story sc-13448).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions github-actions Bot added the docs label Jul 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant