Microsoft Entra ID (formerly Azure AD) - Update Windows Defender Security Intelligence

Microsoft Entra ID (formerly Azure AD) - Update Windows Defender Security Intelligence updates the Windows Defender Security Intelligence app for:

• Assets returned by the selected query or assets selected on the relevant asset page.

Required Fields

These fields must be configured to run the Enforcement Action.

• Use stored credentials from the Microsoft Entra ID (formerly Azure Active Directory) and Microsoft Intune adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

📘

Note

To use this option, you must successfully configure a Microsoft Entra ID (formerly Azure Active Directory) and Microsoft intune Adapter adapter connection.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

  
  

Additional Fields

These fields are optional.

💡

Connection and Credentials

When Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

• Azure Client ID - The Application ID of the Axonius application.

• Azure Client Secret - Specify a non-expired key generated from the new client secret.

• Azure Tenant ID - The ID for Microsoft Entra ID.

• Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

• Enable Certificate-Based Authentication - Select to enable Axonius to send requests using the Azure certificates uploaded to allow secure Azure authentication for this adapter.

• Click Upload File next to Private Key File to upload an Azure private key file in PEM format.

• Click Upload File next to Certificate File to upload an Azure public key file in PEM format.

📘

Note:

The following parameters are only relevant for customers who have SaaS Management enabled.

• Account Sub Domain - The Microsoft account's sub domain (.onmicrosoft.com).
• Username and Password - The credentials for a user account that has the permissions needed to fetch SaaS data.
• 2FA Secret Key - The secret generated in Microsoft Entra ID for setting up 2-factor authentication for the Microsoft user.
• SSO Provider - If your organization uses Microsoft Entra ID for SSO, you can select this check box.

• Gateway Name - Select the Gateway through which to connect to perform the action.

APIs

Axonius uses the Microsoft Graph API.

• Use the https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-windowsdefenderupdatesignatures?view=graph-rest-beta endpoint.

Required Permissions

• DeviceManagementManagedDevices.PrivilegedOperations.All

Version Matrix

This Enforcement Action was tested only with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed and it is not functioning as expected.