Connect Microsoft Defender for Cloud Apps

Imports entities, alerts, IP ranges, discovery report streams and discovered apps from Microsoft Defender for Cloud Apps.

For the general flow of adding a source, see Connect Data Sources.

Before you start

To configure the data source, you can use your M365 interface or use the full PowerShell script that we provide.

Prerequisites

• A Microsoft Defender for Cloud Apps tenant

• Permission to create a Microsoft Entra application and grant tenant-wide admin consent

• A client secret stored securely

Setup

Step 1 — Create an App Registration

1. Sign in to the Microsoft Entra admin center.

2. Open App registrations → New registration.

3. Name it HARVEN-MDCA, select single tenant, and leave Redirect URI blank.

4. Click Register, then note the Application (client) ID and Directory (tenant) ID.

Step 2 — Configure API permissions

API permissions → Add a permission → APIs my organization uses → Microsoft Cloud App Security → Application permissions

API permissions → Add a permission → Microsoft Graph → Application permissions

⚠️ Click Grant admin consent for all three permissions.

Step 3 — Create a Client Secret

1. Open Certificates & secrets.

2. Under Client secrets, click New client secret.

3. Choose a description and expiration period, then click Add.

4. Copy the Value immediately; it is shown only once.

Step 4 — Configure the connector in HARVEN

1. In the Microsoft Defender portal, open Settings.

2. Select Cloud Apps, then under System select About.

3. On the About screen, copy the API URL shown for your tenant and append /api if it is not already present. The final value must look like https://<tenant>.<region>.portal.cloudappsecurity.com/api.

4. In HARVEN, open Workspace → Data Sources → Add → Microsoft Defender for Cloud Apps.

5. Enter the API URL, Tenant ID, Client ID and Client Secret.

Fields to fill in HARVEN

Collected data

• entities — Users, devices and other cloud entities: Identity (entity_id, display_name, type), Account posture (email, status, is_admin)

• alerts — Security alerts and their resolution state: Alert (alert_id, title, severity), Handling (status, resolution_status, resolution_date)

• ip_ranges — Configured IP address ranges: Network range (subnet_id, name, subnets)

• discovery_reports — Continuous discovery report streams: Discovery stream (display_name, stream_type, last_data_received)

• discovered_apps — SaaS apps seen in use by Cloud Discovery, one row per app, discovery stream and report window (preview, Microsoft Graph beta API): App (app_id, display_name, category, risk_score, tags, domains), Usage (user_count, transaction_count, upload_bytes, download_bytes, last_seen), Report stream and window — 7, 30 or 90 days, 30 by default (stream_name, period_days)

PowerShell script

Create the App Registration, assign the permissions and generate the secret in one command, with our PowerShell script.

Download the script

How to run it:

Windows — Right-click the file, Run with PowerShell — or in a terminal:

powershell -ExecutionPolicy Bypass -File .\setup-microsoft-connector.ps1

macOS / Linux — Install PowerShell 7 then run the script:

brew install powershell
pwsh ./setup-microsoft-connector.ps1

Arguments (optional) — Without any argument, the script is fully interactive.

• -Connector <entraid|intune|defender|mdca|azure> — Connector to configure. Omitted: the script asks in a menu.

• -AppName <name> — Name of the App Registration to create (default: HARVEN-<connector>).

• -SubscriptionId <id> — Required for azure: target subscription for the Reader role.

• -IncludeEntraIdWrite — entraid only: adds the remediation permission User.EnableDisableAccount.All.

• -Yes — Non-interactive: skips confirmations and installs missing modules automatically.

The script offers to install the missing modules automatically.

Official documentation

• Defender for Cloud Apps API overview

• Application authentication

Need help? Contact [email protected].