---
title: "Grant Red Canary analysts access to your Microsoft Defender console for Active Remediation"
slug: "grant-red-canary-analysts-access-to-your-microsoft-defender-console-for-active-remediation"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/grant-red-canary-analysts-access-to-your-microsoft-defender-console-for-active-remediation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant Zscaler MDR Access to Your Microsoft Defender Console for Active Remediation

This article guides you through the process of connecting Zscaler MDR to your Microsoft Defender for Endpoint instance as part of the Active Remediation service.

The Active Remediation service requires an additional access package be created using Microsoft Identity Governance. This access package contains an elevated permissions role within a Microsoft Defender For Endpoint role which facilitates Active Remediation service capabilities.

## **Prerequisites**

Before you configure Active Remediation, be sure you’ve connected Zscaler MDR to Defender for Endpoint. For more information, see [Integrate Microsoft Defender for Endpoint with Zscaler MDR](/doc/docs/connect-red-canary-to-microsoft-defender-for-endpoint).

## **Azure: Create the Active Remediation security group**

1. From your [Azure portal](https://portal.azure.com/), log in with your global administrator account.
2. Expand the navigation pane, and then click **Entra Active Directory**.
3. Click **Groups**, and then click **New Group**.
4. Fill in the group parameters with the following values:
  - Group Type: **Security**
  - Group Name: **Zscaler MDR Active Remediation**
  - Group Description: **Zscaler MDR Access Group for Active Remediation**
  - Microsoft Entra AD roles can be assigned to the group: **Yes**
  - Roles: **Security Reader**
  - Membership Type: **Assigned**
  - Owners: **No owners selected**
  - Members: **No members selected**
5. Click **Create**.
6. Click **Yes** at the confirmation prompt.

## **Azure: Add Zscaler MDR as a connected organization**

> **Note**: This step is only applicable if you have not already added Zscaler MDR as a connected organization.

1. Navigate to the Azure Active Directory, and then click **Identity Governance**.
2. Under Entitlement Management, click **Connected organizations**, and then click **Add connected organization**.
3. Fill out the form with the following values:
  - Name: Zscaler MDR
  - Description: Zscaler MDR Access Group
  - State: Configured
  - Click **Add directory + domain**.
  - Type **redcanary.com** into the tenant ID search bar.
  - Highlight the entry, and then click **Select**.
  - Under Add Internal Sponsor, click **Add/Remove**.
  - Search for the name of your active directory administrator, highlight the account, and click **Select**.
4. Review the parameters, and then click **Create**.

## **Microsoft Defender XDR: Enable Role-Based Access controls in Microsoft Defender For Endpoint**

1. Go to the [Microsoft Defender portal](https://security.microsoft.com/).
2. Navigate to **Settings > Microsoft Defender XDR > Permissions and roles**. This brings you to the Activate workloads page.
3. Toggle all available workloads. At a minimum, make sure Endpoints & Vulnerability Management is enabled.
4. Click **Activate** on the confirmation message.
5. In the navigation pane, go to **System >** **Permissions**.
6. Under Microsoft Defender XDR, click **Roles > Create custom role**.
7. Enter your role name and description:
  - Role Name: Zscaler MDR Active Remediation
  - Description: Zscaler MDR Active Remediation Access Role

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/basics.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
8. Click **Next**.
9. Click **Security operations** and **Edit**.
  1. Click **Select custom permissions**.
  2. Under Security data, click **Select custom permissions**. Then select the following options:
    1. Alerts (manage)
    2. Response (manage)
    3. Basic live response (manage)
    4. Advanced live response (manage)
    5. File collection (manage)
  3. Under Raw data (Email and collaboration) click **Select custom permissions**. Then select the following option:
    1. Email & collaboration metadata (read)

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/security ops.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
10. Click **Apply**.
11. Click **Authorization and settings**, then click **Next**.
12. Check the following boxes.
  1. Select **custom permissions**.
  2. Authorization
    1. Select **Read-only**.
  3. Security Settings
    1. Select custom permissions.
      1. Core security settings (read)
  4. System settings
    1. Read-only (Defender for Office, Defender for Identity)

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/auth(1).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
13. Click **Apply**.
14. Click **Apply**.
15. Click **Next**.
16. Click **Create assignment** (or **+add assignment**).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/create(2).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
17. Click **Next**.
18. Add the **Assignment name**.

> [!NOTE]
> **Note**: The name should reflect the assignment.
19. Assign the users and groups.
20. From **Data Sources** ensure all the boxes are checked.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/add ass(1).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
21. Click **Add**.
22. Click **Next**.
23. Review the content and click **Submit**.

## **Microsoft Defender XDR: Grant Zscaler MDR access to device groups**

> **Note**: Ensure that the Zscaler MDR Active Remediation security group has been granted access to the Defender For Endpoint device groups.

This step is applicable only if there are device groups listed. By default, a device group is accessible to all users if there are no group assignments associated with the group.

1. Go to the [Microsoft Defender Portal](https://security.microsoft.com).
2. Navigate to **Settings > Endpoints > Permissions > Device groups**.
3. Go to your device group settings and click **Assigned User Groups**.
4. Select the Zscaler MDR group you created.
5. Add the group to **Entra ID user groups with this role**, then click​ **Save**.

> [!WARNING]
> **IMPORTANT**: Once you've added the Zscaler MDR Group to the Device Groups, be sure to click **Apply Changes**.

## **Azure: Create the Microsoft Azure identity governance catalog**

> **Note**: This step is only applicable if you haven't already created an Identity Governance Catalog for Zscaler MDR.

1. From your [Azure portal](https://portal.azure.com/), log in with your global administrator account.
2. Expand the navigation pane, select **Azure Active Directory**, and then select **Identity Governance**.
3. Under **Entitlement Management**, click **Catalogs**, and then click **New Catalog**.
4. Fill out the form with the following values:
  - Name: Zscaler MDR Access
  - Description: Zscaler MDR Access Catalog
  - Enabled: Yes
  - Enabled for external users: Yes

## **Azure: Create the Microsoft Azure identity governance access packages for Active Remediation**

1. From your [Azure portal](https://portal.azure.com/), log in with your global administrator account.
2. Expand the navigation pane, and then click **Azure Active Directory**.
3. Click **Identity Governance**, **Entitlement Management**, and then click **Catalogs**.
4. Select the **Zscaler MDR Access** catalog.
5. Under Manage, click **Access Packages**, and then click **New Access Package**.
6. Fill out the forms with the following values:
  - Name: Zscaler MDR Active Remediation Access Package
  - Description: Zscaler MDR Active Remediation Access
  - Select **Resource Roles > Groups and Teams >** **Zscaler MDR Active Remediation** and then click **Select**.

> [!TIP]
> **Important:** In order to select the Zscaler MDR Group, make sure to select See all Group and Team(s) not in the Zscaler MDR Access catalog. You must have the correct permissions to add them in this access package.
  - Under Role, click **Member** from the dropdown.
  - Select **Requests Tab**
  - Select **For users not in your directory**, **Specific connected organizations**, and then select **Zscaler MDR**.
  - Require Approval: No
  - Enable new requests: Yes
  - Select **Lifecycle Tab**
  - Access package assignments expire: Never
  - Users can request specific timeline: Yes
  - Require access reviews: Yes
  - Starting on: [today’s date]
  - Review frequency: Bi-annually
  - Duration in days: 90
  - Reviewers: Specific reviewers
    1. Click **Add reviewers**
    2. Select the members of your organization responsible for IAM review procedures
7. Review the parameters, and then click **Create**.
8. From your Azure Portal, click Active Directory, and the click Identity Governance.
9. Click Access Packages, and then click **Zscaler MDR access package.**
10. Under Properties, copy and save the **My access portal link**.
11. Provide the link to your Zscaler MDR contact.

## **Microsoft Defender XDR: Enable Advanced Features in Microsoft Defender For Endpoint**

1. From your [Microsoft Defender XDR](https://security.microsoft.com/) portal, log in with your global administrator account.
2. Click **Settings**, and then click **Endpoints**.
3. Under **General**, click **Advanced Features**.
4. Enable **Custom network indicators**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/custom.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
5. Enable **Live Response**.
6. Enable **Live Response for Servers**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/live response.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)

## **Microsoft Entra: Set up cross-tenant access settings for MFA**

The Zscaler MDR Threat Response Engineering (TRE) team uses Okta as its IDP for Multi-Factor Authentication. We maintain a dedicated RBAC group that exclusively includes our TRE team members. This group’s membership is synchronized with Azure, enabling customers to easily restrict access to only Zscaler MDR TRE. By default, an Access Package will limit logins to Zscaler MDR’s Azure tenant. However, this can be further refined to limit access specifically to the TRE team, providing granular control over who can access your data within our environment. To configure this control, follow the steps on [Set Up Your Microsoft Entra ID Cross-Tenant Access Settings](/doc/docs/set-up-your-microsoft-entra-id-cross-tenant-access-settings).