Microsoft Defender for Endpoint V2 Connector

Have the following ready before starting the connector configuration in Qualys ETM:

1. Ensure you have access to the Azure portal with permissions to register applications in Microsoft Entra ID (Azure Active Directory).
2. Register an application in Microsoft Entra ID and assign the required API permissions for WindowsDefenderATP (see Auth Setup below).
3. Create a Client Secret for the registered application and copy its value immediately — it cannot be retrieved after leaving the page.

Register an Application in Microsoft Entra ID

1. Sign in to the Azure portal and navigate to Microsoft Entra ID > App registrations > New registration.
2. Enter a name for the application, select the appropriate supported account types for your organization, and click Register.
   
3. On the application overview page, note the Application (client) ID and Directory (tenant) ID. Store these securely for use during connector configuration.
   

Create a Client Secret

1. From the registered application page, navigate to Certificates & secrets > New client secret.
2. Enter a description, select an expiration period, and click Add. Microsoft recommends an expiration value of less than 12 months.
   
3. Copy the secret Value immediately. It will not be viewable after you leave the page.

Assign API Permissions

The registered Azure application must have the following Application-level API permissions granted for WindowsDefenderATP. An Azure administrator must grant admin consent for these permissions before the connector can authenticate.

To assign: navigate to API permissions > Add a permission > APIs my organization uses, select WindowsDefenderATP, click Application permissions, and grant the following:

After adding permissions, click Grant admin consent. Admin consent is required — permissions without it result in 403 Forbidden errors during the connection test.

Scope and Data Access

The connector queries the following MDE REST API endpoints:

• https://login.microsoftonline.com/ — OAuth 2.0 token endpoint.
• https://api.security.microsoft.com/api/machines — Retrieves endpoint asset records.
• https://api.security.microsoft.com/api/machines/SoftwareVulnerabilitiesByMachine — Retrieves vulnerability findings per machine.
• https://api.security.microsoft.com/api/machines/${mId} — Retrieves individual machine details.
• https://api.securitycenter.microsoft.com/api/vulnerabilities/machinesVulnerabilities — Retrieves machine-level vulnerability data.

OData v4 query filters are supported on: computerDnsName, osPlatform, deviceValue, exposureLevel, healthStatus, riskScore, onboardingStatus, lastSeen, rbacGroupId, plus $top (max 10,000) and $skip.

Sample filter expressions: deviceValue eq 'Normal'   |   RbacGroupId eq 0 or RbacGroupId eq 7458

Key Rotation

When the Client Secret expires or is rotated in Azure, update the credentials in Qualys ETM via the Edit Connector option before the old secret expires. Expired secrets cause 401 Unauthorized errors on the next connector run.

This step establishes the connector's identity and authenticates it with Microsoft Defender for Endpoint via Microsoft Entra ID.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the Microsoft Defender for Endpoint V2 Connector on the Connector Marketplace and click Add. This is a one-time task.

   Note: If the connector is already added, navigate to My Connectors, search for it, and click Manage Connections.

4. From the connector tile, click Manage Connections.
5. Click Create Connection. The Setup Guide opens with the Before You Begin checklist and four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before continuing.
6. Click Proceed to Setup.
7. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following OAuth 2.0 credentials to authenticate the connector with your Microsoft Entra ID application.

   Field	Type	Description
   Authentication URL (required)	String	The Microsoft OAuth 2.0 token endpoint. Use: https://login.microsoftonline.com/ (include the trailing slash).
   Tenant ID (required)	String	The Directory (tenant) ID from your registered Azure application overview page.
   Client ID (required)	String	The Application (client) ID from your registered Azure application overview page.
   Client Secret (required)	Encrypted String	The Client Secret Value created under Certificates & secrets. Copy this immediately upon creation — it is not shown again.

   
   
8. Click Test Connection. A modal appears showing the status of five sequential checks:
   • Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
   • Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
   • Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
   • Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

   All five checks must pass before you can proceed. See the Troubleshooting section for resolution steps if any check fails.

   
9. Click OK to dismiss the test result modal, then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — Select one of the following:
   • Assets & Findings — Ingests both host asset records and associated CVE-based vulnerability findings.
   • Assets — Ingests host asset records only, without vulnerability findings.
2. Advanced Settings (optional) — Click Advanced Settings to configure filters, review the active transform map, and customize risk severity mappings. See Advanced Settings below.
3. Schedule — Select an execution frequency from the Occurs dropdown (for example, Daily). The system displays the calculated start date, end date, and timezone.

   Note: The timezone is determined by your Qualys account settings. The connector runs from the configured start date for a default period of 5 years.

4. Click Next.

Sampling Mode - Limit Sync to Top 1,000 Assets and Findings

Sampling Mode can restrict data ingestion to a targeted subset of up to 1,000 assets and their associated findings. You can quickly validate integration and review meaningful security data without a full environment sync.

You can select the Limit sync to top 1,000 assets and findings checkbox to limit the fetch 1000 assets using risk-based filter criteria. The assets, along with their associated findings, are discovered and shared with ETM. The connector applies risk-based filters during asset fetch to ensure the ingested subset represents the most relevant assets in your environment rather than a random or arbitrary sample.
Assets with active findings are fetched and ingested along with their associated vulnerabilities, ensuring only endpoints with confirmed security issues are included in the dataset.

Review your changes and click Create.