Integrate Microsoft Defender for Endpoint with Red Canary
- 06 Oct 2025
- 8 Minutes to read
- PDF
Integrate Microsoft Defender for Endpoint with Red Canary
- Updated on 06 Oct 2025
- 8 Minutes to read
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback!
Integrating Microsoft Defender for Endpoint with Red Canary strengthens your endpoint security by combining threat detection, investigation, and response capabilities across both platforms. This guide walks you through the steps needed to connect Red Canary to your Microsoft Defender for Endpoint instance, enabling a more effective and coordinated approach to endpoint protection.
Prerequisites
Before you start the Microsoft Defender for Endpoint integration, please make sure the following requirements are met:
Your device meets Microsoft’s minimum requirements for Microsoft Defender for Endpoint
You’re a Microsoft global admin user
1 Red Canary | Set up Your Red Canary Account
When you first sign up with Red Canary, you’ll need to:
Provide the name and email address with global admin privileges to your Technical Implementation Manager.
Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, notify your Technical Implementation Manager who will provide you with an invitation link.
Note
When logging in to your Red Canary portal, you should be prompted to accept certain permissions. Only Global Administrators can approve admin consent requests.
If you do not see this permissions page on your first login, try opening this link in an incognito browser window. To learn more about permissions Red Canary requires and why we need them, see Permissions Requirements for Microsoft.
2 Microsoft Defender Portal | Export Data to Red Canary
After you configure your onboarding account, you can set up data export from your Defender for Endpoint instance to Red Canary’s Event Hub. This configuration instructs the Defender for Endpoint platform send your telemetry to Red Canary.
In your Microsoft Defender Portal, navigate to Settings > Microsoft Defender XDR > Streaming API.
Click + Add.
Name the export “Red Canary.”
Click Forward events to Event Hub.
Fill in the “Event Hubs” and “Event Hubs ID” fields using the credentials Red Canary has provided to you via email.
Select all Event Types.
Click Submit. It will take 30 minutes to four hours after the final step is completed before the data stream is established within Red Canary.
Note: If you get a “Failed to created Streaming API Settings Request Body is invalid or missing” error, try the steps below:
Verify the “Event Hubs” and “Event Hubs ID” fields:
Check for extra spaces: Ensure that there are no leading or trailing spaces in the Event Hub Resource ID and Event Hub name fields.
Use a plain text editor: To be certain, copy the Resource ID and name and paste them into a plain text editor. This will remove any hidden formatting or spaces. Then, copy the cleaned text and resubmit.
Refresh your session:
Completely clear all the data you've entered in the event fields. Then, refresh the entire browser window and try entering the information again.
Open a new incognito or private browser window and fill out the fields again.
3 Red Canary | Grant Red Canary Permissions to Defender for Endpoint API
Grant Red Canary permissions to your Defender for Endpoint API. This enables the Red Canary platform to retrieve alerts, process endpoint metadata, and orchestrate actions on endpoints.
Log in to your Microsoft account (MFA is required).
Approve permissions for Red Canary API integration.
To learn more about permissions Red Canary requires and why we need them, see Permission Requirements for Microsoft.
4 Red Canary | Grant Red Canary Analysts Read-only Access to your Microsoft Defender Console
Grant Red Canary read-only access to your Defender for Endpoint console using role-based access control. This enables your Red Canary teams, such as your threat hunting and detection engineering teams, to perform ad-hoc hunting and investigation of potential threats in your environment. For more information, see Manage portal access using role-based access control.
If you have an Entra ID Premium P2 license, follow the steps below.
1 Microsoft Entra Admin Center | Create a Red Canary Security Group
Go to the Microsoft Entra Admin Center.
Navigate to Entra ID > Groups > Overview > New Group.
Update the following parameters:
Group type: “Security”
Group name: “Red Canary”
Group description: “Red Canary Access Group”
Roles: Security Reader
Membership type: Assigned
Microsoft Entra roles can be assigned to the group: Yes
Owners: No owners selected
Members: No members selected
Click Create.
2 Microsoft Entra Admin Center | Add Red Canary as a Connected Organization
Click Identity Governance (you may need to enter this in the search bar).
Under Entitlement Management, select Connected organizations > Add connected organization.
Fill out the form with the following values:
Basics:
Name: “Red Canary”
Description: “Red Canary Access Group”
State: “Configured”
Directory + domain
Click Add directory + domain.
Type “redcanary.com” into the tenant ID search bar.
Highlight the entry and click Select.
Sponsors
Under Add Internal Sponsor, click Add/Remove.
Search for the name of your active directory administrator, highlight the account, and click Select.
Click Create.
3 Microsoft Defender Portal | Create a RBAC Role
Create a RBAC role within Defender for your endpoint and assign the Red Canary Entra ID security group to the role.
Go to the Microsoft Defender portal.
Navigate to System > Settings > Microsoft Defender XDR > Permissions and roles.
Under Workloads, toggle all available workloads. At a minimum, make sure Endpoints & Vulnerability Management is enabled.
Click Activate on the confirmation message.
Click Go to Permissions and Roles.
Under Microsoft Defender XDR, click Roles > Create custom role.
Fill out the form with the following values:
Role Name: “Red Canary”
Description: “Red Canary Access Role”
Click Next.
Under Permissions, select Security Operations.
Check the following boxes:
Select custom permissions
Security data > Select custom permissions > Security data basics (read)
Raw data (Email and collaboration) > Select custom permissions > Email & collaboration metadata (read)
Click Apply.
Click Authorization and settings, then click Next.
Check the following boxes.
Custom permissions
Authorization > Read-only
Security Settings > Custom permissions > Core security settings (read)
System settings > Read-only (Defender for Office, Defender for Identity)
Click Apply.
Click Next.
Click Create assignment (or + Add assignment).
.png?sv=2022-11-02&spr=https&st=2025-10-08T23%3A02%3A18Z&se=2025-10-08T23%3A12%3A18Z&sr=c&sp=r&sig=StfjSDyPbdMZw3huv7tEllYTmMqZcEq%2B4WijATn12Cs%3D)
Click Next.
Name the assignment “Read Canary Read Only Assignment.”
In Assign the users and groups, add “Red Canary”.
Under Data Sources, check all sources.
.png?sv=2022-11-02&spr=https&st=2025-10-08T23%3A02%3A18Z&se=2025-10-08T23%3A12%3A18Z&sr=c&sp=r&sig=StfjSDyPbdMZw3huv7tEllYTmMqZcEq%2B4WijATn12Cs%3D)
Click Add > Next > Submit.
4 Microsoft Entra Admin Center | Configure your Microsoft Entra Identity Governance Access Packages
Navigate to Microsoft Entra Admin Center.
Click ID Governance > Entitlement management > Catalogs > New Catalog.
Fill out the form with the following values:
Name: Red Canary Access
Description: Red Canary MTP Service Access Catalog
Enabled: Yes
Enabled for external users: Yes
Click Create.
In the main Entra Admin Center, click ID Governance > Entitlement management > Access package > New Access Package.
Fill out the forms with the following values:
Basics:
Name: Red Canary Access Package
Description: Red Canary Access
Catalog: Red Canary Access
Resource roles:
+ Groups and Teams: Red Canary (Role: Member)
In order to select the Red Canary Group, make sure to check the box See all Group and Team(s) not in the Red Canary Access catalog. If you’re unable to see the Red Canary Group, you might not have the correct permissions.
Requests:
For users not in your directory > Specific connected organizations > Red Canary
Require approval: No
Enable new requests and assignments: Yes
Lifecycle:
Access package assignments expire: Never
Users can request specific timeline: No
Require access reviews: Yes
Starting on: [today's date]
Review frequency: Bi-annually
Duration in days: 90
Reviewers: Specific reviewers
Click Add reviewers.
Select the members of your organization responsible for IAM review procedures.
Click Create.
On the Identity Overview Governance page, click the newly created access package Red Canary.
Under Properties, copy My access portal link.
Provide the link to your Red Canary contact.
If you have an Entra ID Premium P1 license, contact your Red Canary account representative to walk you through the steps below.
(Entra Admin Center) Step 1: Create a Red Canary Security Group
Go to the Microsoft Entra Admin Center.
Navigate to Entra ID > Groups > Overview > New Group.
Fill in the parameters with the following:
Group type: “Security”
Group name: “Red Canary”
Group description: “Red Canary Access Group”
Roles: Security Reader
Membership type: Assigned
Microsoft Entra roles can be assigned to the group: Yes
Owners: No owners selected
Members: No members selected
Click Create.
(Defender Portal) Step 2: Create a RBAC role and assign it to Red Canary Security Group
Go to the Microsoft Defender portal.
Navigate to System > Permissions.
Under Microsoft Defender XDR, click Roles > Create custom role.
Fill out the form with the following values:
Role name: “Red Canary”
Description: “Red Canary Access Role”
Click Next.
Under Permissions, select Security Operations.
Check the following boxes:
Select custom permissions
Security data:
Select custom permissions
Security data basics (read)
Raw data (Email and collaboration):
Select custom permissions
Email & collaboration metadata (read)
Click Apply, then Next.
Check the following boxes:
Select custom permissions
Authorization: Read-only
Security settings:
Select custom permissions
Core security settings (read)
System settings:
Read-only (Defender for Office, Defender for Identity)
Click Apply, then Next.
Click Create assignment (or + Add assignment).
.png?sv=2022-11-02&spr=https&st=2025-10-08T23%3A02%3A18Z&se=2025-10-08T23%3A12%3A18Z&sr=c&sp=r&sig=StfjSDyPbdMZw3huv7tEllYTmMqZcEq%2B4WijATn12Cs%3D)
Click Next.
Add the Assignment name.
Note: The name should reflect the assignment.
In the Assign the users and groups field, add Red Canary RCsupport.
From Data Sources ensure all the boxes are checked.
Click Add, then Next.
Review the content and click Submit.
(Entra Admin Center) Step 3: Add Red Canary shared user account to your Entra Security Group
Go to the Microsoft Entra Admin Center.
Expand the navigation pane and click Entra ID.
Click Users.
Click Invite User.
Fill in the group parameters with the following:
Identity
User Name: “redcanary”
Email Address: “svc-customer-defender-[subdomain]@redcanary.com”
Note
Red Canary will provide this address via email.
Name: “Red Canary”
First Name: Leave blank
Last Name: Leave blank
Groups and Roles
Groups: Select the Red Canary group you just created
Roles: Don't select a role
Settings
Block Login: Off
Usage Location: United States
Job Info: Leave blank
Click Create.
5 Microsoft Defender Portal | Add Permissions to Device/Machine Groups
If your organization uses device groups, add permissions by completing the following steps:
Go to the Microsoft Defender Portal.
Navigate to Settings > Endpoints > Permissions > Device groups.
Go to your device group settings and click Assigned User Groups.
Select the Red Canary group you created in Step 3.
Add the group to Entra ID user groups with this role, then click Save.
IMPORTANT: Once you've added the Red Canary Group to the Device Groups, be sure to click Apply Changes.
6 Red Canary | Integrate Microsoft Graph with Red Canary
If you have Red Canary Complete or Enterprise subscriptions, you’ll need to set up our Microsoft Graph integration to get alerts and telemetry data to Red Canary. Follow the steps on Integrate Microsoft Graph with Red Canary.
Was this article helpful?