Microsoft Defender

Attach Microsoft Defender to Detect

To attach a Microsoft Defender account to Detect, you will need:

  • The Prelude CLI
  • An Azure user with Global Administrator role

In Azure

Create an app

Follow the official Microsoft Defender documentation to create a new app. While you walk through the guide:

  • Please take note of your app's TENANT ID (step 7), APP ID (step 7), and APP SECRET (step 6)
  • You do not need to create a multi-tenant app (step 8)
  • This integration requires:
    • User.Read
    • Alert.Read.All
    • Machine.Read.All
    • Machine.ReadWrite.All
    • Ti.ReadWrite.All

Note: After adding the above permissions ensure you click the "Grant admin consent for user" as highlighted in the screenshot below.

To see IOC's submitted via Prelude:Under the Microsoft 365 Defender portal: browse to Settings > Endpoints > Rules/Indicators (

Note: Microsoft Defender has the following requirements to enable hash/IOC blocking:

In Prelude

Attach the partner via UI

  • Navigate to your user name in upper right hand corner and select "Integrations"
  • "Connect to Windows Defender"
  • Fill out Base URL, Tenant ID, APP ID and App Secret to connect

Attach the partner via CLI

Run the following command to attach the partner

prelude partner attach defender --user <TENANT_ID> --secret <APP_ID>/<APP_SECRET> --api <HOST>

--api is an required field that should be set to Optionally can be set to hit one of Microsoft's regional endpoints, example https://api-<REGION>

Your account credentials are stored, encrypted at REST, behind the Prelude Service API.

After attachment, the Prelude Service will send your Defender account a new IOC every time a probe reports a test in the UNPROTECTED state. Following this report, Defender should start catching the test.

Detach the partner via UI

    • Navigate to your user name in upper right hand corner and select "Integrations"
  • "Disconnect Windows Defender"

Detach the partner via CLI

To detach the partner from your account, run:

prelude partner detach defender