Grant Red Canary Access to Your Microsoft Defender Console for Active Remediation

1. From your Azure portal, log in with your global administrator account.

2. Expand the navigation pane, and then click Entra Active Directory.

3. Click Groups, and then click New Group.

4. Fill in the group parameters with the following values:

   • Group Type: Security

   • Group Name: Red Canary Active Remediation

   • Group Description: Red Canary Access Group for Active Remediation

   • Microsoft Entra AD roles can be assigned to the group: Yes

   • Roles: Security Reader

   • Membership Type: Assigned

   • Owners: No owners selected

   • Members: No members selected

5. Click Create.

6. Click Yes at the confirmation prompt.

Note: This step is only applicable if you have not already added Red Canary as a connected organization.

1. Navigate to the Azure Active Directory, and then click Identity Governance.

2. Under Entitlement Management, click Connected organizations, and then click Add connected organization.

3. Fill out the form with the following values:

   • Name: Red Canary

   • Description: Red Canary Access Group

   • State: Configured

   • Click Add directory + domain.

   • Type redcanary.com into the tenant ID search bar.

   • Highlight the entry, and then click Select.

   • Under Add Internal Sponsor, click Add/Remove.

   • Search for the name of your active directory administrator, highlight the account, and click Select.

4. Review the parameters, and then click Create.

1. From your Microsoft Defender XDR portal, log in with your global administrator account.

2. Click Settings, and then click Endpoints.

3. Click Roles.

4. Click Add item.

5. Fill out the form with the following values:

   • Role Name: Red Canary Active Remediation

   • Description: Red Canary Active Remediation Access Role

     

6. Click Security operations and Edit.

   1. Click Select custom permissions.

   2. Under Security data, click Select custom permissions. Then select the following options:

      1. Alerts (manage)

      2. Response (manage)

      3. Basic live response (manage)

      4. Advanced live response (manage)

      5. File collection (manage)

   3. Under Raw data (Email and collaboration) click Select custom permissions. Then select the following option:

      1. Email & collaboration metadata (read)

         

7. Click Apply.

8. Click Authorization and settings, then click Next.

9. Check the following boxes.

   1. Select custom permissions.

   2. Authorization

      1. Select Read-only.

   3. Security Settings

      1. Select custom permissions.

         1. Core security settings (read)

   4. System settings

      1. Read-only (Defender for Office, Defender for Identity)

         

10. Click Apply.

11. Click Apply.

12. Click Next.

13. Click Create assignment (or +add assignment).

    

14. Click Next.

15. Add the Assignment name.

    Note: The name should reflect the assignment.

16. Assign the users and groups.

17. From Data Sources ensure all the boxes are checked.

    

18. Click Add.

19. Click Next.

20. Review the content and click Submit.

Note: Ensure that the Red Canary Active Remediation security group has been granted access to the Defender For Endpoint device groups.

This step is applicable only if there are device groups listed. By default, a device group is accessible to all users if there are no group assignments associated with the group.

1. From your Microsoft Defender XDR portal, log in with your global administrator account. 

2. Click Settings, and then click Endpoints.

3. Click Device Group.

4. Review the User Access Column in the list of Device Groups.

5. Ensure that the Red Canary Active Remediation group is listed under User Access for the group.

Note: This step is only applicable if you haven't already created an Identity Governance Catalog for Red Canary.

1. From your Azure portal, log in with your global administrator account. 

2. Expand the navigation pane, select Azure Active Directory, and then select Identity Governance. 

3. Under Entitlement Management, click Catalogs, and then click New Catalog.

4. Fill out the form with the following values:

   • Name: Red Canary Access

   • Description: Red Canary Access Catalog

   • Enabled: Yes

   • Enabled for external users: Yes

1. From your Azure portal, log in with your global administrator account. 

2. Expand the navigation pane, and then click Azure Active Directory.

3. Click Identity Governance, Entitlement Management, and then click Catalogs. 

4. Select the Red Canary Access catalog.

5. Under Manage, click Access Packages, and then click New Access Package.

6. Fill out the forms with the following values:

   • Name: Red Canary Active Remediation Access Package

   • Description: Red Canary Active Remediation Access

   • Select Resource Roles > Groups and Teams > Red Canary Active Remediation and then click Select.

     Important: In order to select the Red Canary Group, make sure to select See all Group and Team(s) not in the Red Canary Access catalog. You must have the correct permissions to add them in this access package.

   • Under Role, click Member from the dropdown.

   • Select Requests Tab

   • Select For users not in your directory, Specific connected organizations, and then select Red Canary.

   • Require Approval: No

   • Enable new requests: Yes

   • Select Lifecycle Tab

   • Access package assignments expire: Never 

   • Users can request specific timeline: Yes

   • Require access reviews: Yes

   • Starting on: [today's date]

   • Review frequency: Bi-annually

   • Duration in days: 90

   • Reviewers: Specific reviewers

     1. Click Add reviewers

     2. Select the members of your organization responsible for IAM review procedures

7. Review the parameters, and then click Create.

8. From your Azure Portal, click Active Directory, and the click Identity Governance.

9. Click Access Packages, and then click Red Canary access package.

10. Under Properties, copy and save the My access portal link.

11. Provide the link to your Red Canary contact.

1. From your Microsoft Defender XDR portal, log in with your global administrator account.

2. Click Settings, and then click Endpoints. 

3. Under General, click Advanced Features.

4. Enable Custom network indicators. 

   

5. Enable Live Response. 

6. Enable Live Response for Servers.