topic Re: XSOAR app integration with Microsoft 365 Defender in Cortex XSOAR Discussions

XSOAR app integration with Microsoft 365 Defender

jplamarre — Sun, 23 Jul 2023 09:54:13 GMT

Hi,

PAN has published an Azure AD app for both integration of Microsoft Defender for Endpoint (MDE) and Microsoft 365 Defender (M365D). The instructions to use the app are very clear and it works well for MDE but I had no luck for M365D. PAN reference a different app ID in the documentation specific to M365D but there's no instruction on how to find the app. Does anybody have a clue how to use the XSOAR App for M365D ?

Re: XSOAR app integration with Microsoft 365 Defender

cpayne26 — Thu, 27 Jul 2023 14:02:30 GMT

Good morning.

The renaming of the microsoft products gets me confused too. Microsoft Threat Protection is a former name for microsoft 365 defender to find it when adding API permissions in your application page you need to select API permission > add permissions > APIs my organization uses > (then in the search bar) type Microsoft Threat Protection and select that app. You should then be able to see the permissions you're looking for. source: https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-create-app-user-context?view=o365-worldwide#create-an-app. Let us know if this helps.

Re: XSOAR app integration with Microsoft 365 Defender

jplamarre — Thu, 31 Aug 2023 13:15:28 GMT

Hi, Thanks for the solution but this is using the Self-Deployed application method. This is already working. What I'm trying to do is to use the Palo-Alto registered App, what is called the "Cortex XSOAR App"

Re: XSOAR app integration with Microsoft 365 Defender

chrking — Tue, 24 Oct 2023 07:41:41 GMT

Which flow are you trying to use?

The device code flow should handle finding the app for you as far as I can tell.