Skip to main content
We've launched our new Knowledge Base! Read the announcement →

Draft: Microsoft Defender Integration

Updated

Follow these steps to connect Microsoft Defender to SoSafe’s Human Risk OS for risk scoring:

  1. In the Manager, navigate to Settings / Integrations

  2. In the section HROS - Human Risk Management, identify the box Microsoft Defender for Endpoint and select Connect. A new dialog window will open.

    SoSafe Manager Integrations page, HROS Human Risk Management section, with the Microsoft Defender for Endpoint card highlighted next to Connect buttons for Microsoft Entra ID, Okta, and Crowdstrike.

  3. As part of this step, you will leave the Manager. Select Connect and a new window will open. You will be prompted to log in with your Microsoft admin credentials.

    MS Defender for Endpoint Integration dialog showing the Leen and Microsoft Defender icons linked, with text granting Leen access via OAuth, a five minute validity countdown, and Cancel and Connect buttons.

SoSafe uses Leen as the sub-processor for the integration data. For additional information on this connection, please check Leen.dev (Microsoft Defender Integration)

  1. On this screen, you can review the permissions granted to the integration. Select Accept to grant access.

    Microsoft permissions consent screen for the Leen app, listing requested permissions Read all alerts, Read all machine profiles, Read all IOCs, and Sign in and read user profile, with Cancel and Accept buttons.

5. You will be redirected to the Manager. You should be seeing a confirmation message indicating the the integration was connected. In addtion, the Microsoft Defender for Endpoint box should now show a green Connected status indicator.