You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1.Log on to [Azure](https://portal.azure.com) with your **Global administrator** user.
56
+
1.Sign in to the [Azure portal](https://portal.azure.com).
57
57
58
58
2. Navigate to **Microsoft Entra ID**\>**App registrations**\>**New registration**.
59
59
60
60
:::image type="content" source="../media/atp-azure-new-app2.png" alt-text="The App registrations option under the Manage pane in the Microsoft Entra admin center" lightbox="../media/atp-azure-new-app2.png":::
61
61
62
-
3. In the registration form, choose a name for your application and then click**Register**.
62
+
3. In the registration form, choose a name for your application and then select**Register**.
63
63
64
64
4. Allow your Application to access Defender for Endpoint and assign it **'Read all alerts'** permission:
65
65
66
-
- On your application page, click**API Permissions**\>**Add permission**\>**APIs my organization uses** > type **WindowsDefenderATP** and click on**WindowsDefenderATP**.
66
+
- On your application page, select**API Permissions**\>**Add permission**\>**APIs my organization uses** > type **WindowsDefenderATP** and select**WindowsDefenderATP**.
67
67
68
68
> [!NOTE]
69
69
> WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear.
70
70
71
71
:::image type="content" source="../media/add-permission.png" alt-text="The API permissions option under the Manage pane in the Microsoft Entra admin center" lightbox="../media/add-permission.png":::
- Choose **Application permissions**\>**Alert.Read.All**, and then select**Add permissions**.
74
74
75
75
:::image type="content" source="../media/application-permissions.png" alt-text="The permission type and settings panes in the Request API permissions page" lightbox="../media/application-permissions.png":::
76
76
77
77
> [!IMPORTANT]
78
-
> You need to select the relevant permissions. 'Read All Alerts' is only an example!
78
+
> You need to select the relevant permissions. **Read All Alerts** is only an example.
79
79
80
80
For example:
81
81
82
82
- To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission.
83
83
- To [isolate a machine](isolate-machine.md), select 'Isolate machine' permission.
84
-
- To determine which permission you need, please look at the **Permissions** section in the API you are interested to call.
84
+
- To determine which permission you need, see the **Permissions** section in the API you're interested to call.
85
85
86
-
5.Click**Grant consent**.
86
+
5.Select**Grant consent**.
87
87
88
88
> [!NOTE]
89
89
> Every time you add permission, you must click on **Grant consent** for the new permission to take effect.
@@ -92,7 +92,7 @@ For the Application registration stage, you must have a **Global administrator**
92
92
93
93
6. Add a secret to the application.
94
94
95
-
Click**Certificates & secrets**, add description to the secret and click**Add**.
95
+
Select**Certificates & secrets**, add description to the secret and select**Add**.
96
96
97
97
> [!IMPORTANT]
98
98
> After click Add, **copy the generated secret value**. You won't be able to retrieve after you leave!
@@ -105,12 +105,12 @@ For the Application registration stage, you must have a **Global administrator**
105
105
106
106
:::image type="content" source="../media/app-and-tenant-ids.png" alt-text="The application details pane under the Overview menu item in the Microsoft Entra admin center" lightbox="../media/app-and-tenant-ids.png":::
107
107
108
-
Done! You have successfully registered an application!
108
+
Done! You've successfully registered an application!
109
109
110
110
### Step 2 - Get a token using the App and use this token to access the API.
111
111
112
-
- Copy the script below to PowerShell ISE or to a text editor, and save it as **Get-Token.ps1**.
113
-
- Running this script will generate a token and will save it in the working folder under the name **Latest-token.txt**.
112
+
- Copy the following script to PowerShell ISE or to a text editor, and save it as `Get-Token.ps1`.
113
+
- Running this script generates a token and saves it in the working folder under the name `Latest-token.txt`.
114
114
115
115
```powershell
116
116
# That code gets the App Context Token and save it to a file named "Latest-token.txt" under the current directory
@@ -145,8 +145,8 @@ Done! You have successfully registered an application!
145
145
146
146
### Let's get the Alerts!
147
147
148
-
- The script below will use **Get-Token.ps1** to access the API and will get the past 48 hours Alerts.
149
-
- Save this script in the same folder you saved the previous script **Get-Token.ps1**.
148
+
- The following script uses `Get-Token.ps1` to access the API and gets alerts for the past 48 hours.
149
+
- Save this script in the same folder you saved the previous script `Get-Token.ps1`.
150
150
- The script creates two files (json and csv) with the data in the same folder as the scripts.
151
151
152
152
```powershell
@@ -185,16 +185,17 @@ Done! You have successfully registered an application!
Copy file name to clipboardExpand all lines: defender-endpoint/api/exposed-apis-create-app-nativeapp.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.service: defender-endpoint
6
6
ms.author: siosulli
7
7
author: siosulli
8
8
ms.localizationpriority: medium
9
-
ms.date: 01/25/2023
9
+
ms.date: 06/24/2024
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -44,11 +44,11 @@ This page describes how to create an application to get programmatic access to D
44
44
45
45
If you need programmatic access Microsoft Defender for Endpoint without a user, refer to [Access Microsoft Defender for Endpoint with application context](exposed-apis-create-app-webapp.md).
46
46
47
-
If you are not sure which access you need, read the [Introduction page](apis-intro.md).
47
+
If you're not sure which access you need, read the [Introduction page](apis-intro.md).
48
48
49
-
Microsoft Defender for Endpoint exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate work flows and innovate based on Microsoft Defender for Endpoint capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
49
+
Microsoft Defender for Endpoint exposes much of its data and actions through a set of programmatic APIs. Those APIs enable you to automate work flows and innovate based on Microsoft Defender for Endpoint capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
50
50
51
-
In general, you'll need to take the following steps to use the APIs:
51
+
In general, you need to take the following steps to use the APIs:
52
52
53
53
- Create a Microsoft Entra application
54
54
- Get an access token using this application
@@ -65,23 +65,23 @@ This page explains how to create a Microsoft Entra application, get an access to
65
65
66
66
## Create an app
67
67
68
-
1.Log on to [Azure](https://portal.azure.com) with a user account that has the **Global Administrator** role.
68
+
1.Sign in to the [Azure portal](https://portal.azure.com).
69
69
70
70
2. Navigate to **Microsoft Entra ID**\>**App registrations**\>**New registration**.
71
71
72
72
:::image type="content" source="../media/atp-azure-new-app2.png" alt-text="The App registrations page in the Microsoft Azure portal" lightbox="../media/atp-azure-new-app2.png":::
73
73
74
74
3. When the **Register an application** page appears, enter your application's registration information:
75
-
-**Name** - Enter a meaningful application name that will be displayed to users of the app.
75
+
-**Name** - Enter a meaningful application name that is displayed to users of the app.
76
76
-**Supported account types** - Select which accounts you would like your application to support.
77
77
78
78
<br>
79
79
80
80
|Supported account types|Description|
81
81
|---|---|
82
-
|**Accounts in this organizational directory only**|Select this option if you're building a line-of-business (LOB) application. This option is not available if you're not registering the application in a directory. <p> This option maps to Microsoft Entra-only single-tenant. <p> This is the default option unless you're registering the app outside of a directory. In cases where the app is registered outside of a directory, the default is Microsoft Entra multi-tenant and personal Microsoft accounts.|
83
-
|**Accounts in any organizational directory**|Select this option if you would like to target all business and educational customers. <p> This option maps to a Microsoft Entra-only multi-tenant. <p> If you registered the app as Microsoft Entra-only single-tenant, you can update it to be Microsoft Entra multi-tenant and back to single-tenant through the **Authentication** blade.|
84
-
|**Accounts in any organizational directory and personal Microsoft accounts**|Select this option to target the widest set of customers. <p> This option maps to Microsoft Entra multi-tenant and personal Microsoft accounts. <p> If you registered the app as Microsoft Entra multi-tenant and personal Microsoft accounts, you cannot change this in the UI. Instead, you must use the application manifest editor to change the supported account types.|
82
+
|**Accounts in this organizational directory only**|Select this option if you're building a line-of-business (LOB) application. This option isn't available if you're not registering the application in a directory. <br/><br/> This option maps to Microsoft Entra-only single-tenant. <br/><br/> This option is the default option unless you're registering the app outside of a directory. In cases where the app is registered outside of a directory, the default is Microsoft Entra multitenant and personal Microsoft accounts.|
83
+
|**Accounts in any organizational directory**|Select this option if you would like to target all business and educational customers. <br/><br/> This option maps to a Microsoft Entra-only multitenant. <br/><br/> If you registered the app as Microsoft Entra-only single-tenant, you can update it to be Microsoft Entra multitenant and back to single-tenant through the **Authentication** blade.|
84
+
|**Accounts in any organizational directory and personal Microsoft accounts**|Select this option to target the widest set of customers. <br/><br/> This option maps to Microsoft Entra multitenant and personal Microsoft accounts. <br/><br/> If you registered the app as Microsoft Entra multitenant and personal Microsoft accounts, you can't change this in the UI. Instead, you must use the application manifest editor to change the supported account types.|
85
85
86
86
-**Redirect URI (optional)** - Select the type of app you're building, **Web** or **Public client (mobile & desktop)**, and then enter the redirect URI (or reply URL) for your application.
87
87
@@ -113,7 +113,7 @@ This page explains how to create a Microsoft Entra application, get an access to
113
113
114
114
- To [run advanced queries](run-advanced-query-api.md), select **Run advanced queries** permission.
115
115
- To [isolate a device](isolate-machine.md), select **Isolate machine** permission.
116
-
- To determine which permission you need, view the **Permissions** section in the API you are interested to call.
116
+
- To determine which permission you need, view the **Permissions** section in the API you're interested to call.
0 commit comments