Overview
The Microsoft Defender context connector builds a picture of your devices, installed software, vulnerabilities, and device logon activity into Torq's organizational Context Graph. This gives Torq the context it needs to enrich alerts, support investigations, and power the Context Graph page.
Key benefits
Simplified setup: A single app registration and three values: Tenant ID, Client ID, and Client Secret. No hostnames, regions, or per-service configuration required.
Richer triage: Auto Triage uses the Context Graph to enrich alerts with device posture, criticality, installed software, and vulnerability exposure, helping analysts judge severity faster.
Flexible scoping: Grant only the permissions relevant to your Defender licensing and use case. The connector ingests whatever is available.
Built-in reliability: Pagination, state tracking, and error handling are managed automatically to ensure consistent data delivery.
This is a context and enrichment connector. It builds a picture of your devices, software, and posture into Torq's organizational Context Graph. It does not route alerts or events into Torq for triage. Detection routing is handled by the Microsoft Defender data connector.
Common scenarios
The same Context Graph powers multiple use cases, regardless of which vendors are connected.
Improving alert triage with device posture
When an alert involves a device, Auto Triage enriches it with context from the Context Graph, including device criticality, exposure level, installed software, and known vulnerabilities. This context is incorporated into the triage verdict and displayed in the alert's Context Graph section. For example, an alert on an internet-facing device with a known exploitable vulnerability may warrant a different response than one on a low-exposure, fully patched machine.
Investigating entities and relationships
The Context Graph page is where analysts can explore devices, software, accounts, and their relationships without switching between vendor consoles. Common questions include:
What software is installed on this device, and is any of it vulnerable?
Which accounts log on to this device?
Is this the same device seen in another security tool?
How are these entities connected?
Prerequisites
Before setting up the Microsoft Defender context connector, ensure the following:
Azure AD app registration: Create an app registration in Microsoft Entra ID with a client secret prior to configuration. The connector requires three values: Tenant ID, Client ID, and Client Secret.
API permissions: Grant the following Application permissions on the app registration. Each requires admin consent for the tenant.
Permission | API | What it enables |
| WindowsDefenderATP | Device inventory |
| WindowsDefenderATP | Software inventory, and which software is installed on which device |
| WindowsDefenderATP | Which accounts log on to which devices |
| WindowsDefenderATP | Known vulnerabilities, both org-wide and per device |
| WindowsDefenderATP | Exposure and configuration scores |
| WindowsDefenderATP | Security recommendations raised against devices |
| Microsoft Graph | Additional device details: serial number, hardware UUID, cloud resource IDs |
Grant all permissions in a single admin consent. Per-device software, per-device vulnerabilities, and logon-user data depend on Machine.Read.All being granted. ThreatHunting.Read.All enables reliable cross-tool device matching by returning serial numbers, which lets Torq recognize the same device across different security tools. If a permission is not granted, Torq skips that data, and the rest of the integration continues to work.
Licensing
A permission only returns data if the corresponding Microsoft license is active:
Device inventory: Defender for Endpoint P1 or above
Software inventory, vulnerabilities, scores, and security recommendations: Defender for Endpoint P2, or the Defender Vulnerability Management add-on
Serial number and advanced hunting data: Defender XDR enabled, typically Microsoft 365 E5 or E5 Security
Azure cloud posture data: Microsoft Defender for Cloud free foundational tier for inventory, assessments, and secure score; detailed per-resource vulnerability findings require a paid plan
If the license is missing, the data will not appear even with the permission granted.
Azure cloud posture
Azure cloud posture data surfaces your Azure subscription and resource inventory, security assessments, and secure score. Unlike the API permissions above, access is granted through an Azure role assignment (Reader or Security Reader) on each target subscription, rather than an app-registration permission. This can be configured during initial setup or added later.
How to use
Create an app registration in Azure
Log in: Go to the Azure portal and log in with an admin account.
Create a registration: Go to Microsoft Entra ID > App registrations and click New registration.
Name the app: Enter a unique, meaningful name (for example,
Torq Integration), leave the default account type, and click Register.Add WindowsDefenderATP permissions: Go to API permissions > Add a permission > APIs my organization uses, search for WindowsDefenderATP, and select it. Choose Application permissions and add
Machine.Read.All,Software.Read.All,User.Read.All(listed as Read user profiles),Vulnerability.Read.All,Score.Read.All, andSecurityRecommendation.Read.All. Click Add permissions.Add the Microsoft Graph permission: Click Add a permission > Microsoft Graph > Application permissions, add
ThreatHunting.Read.All, and click Add permissions.Grant admin consent: Click Grant admin consent for [your org] and confirm. All permissions must show a green granted status.
Create a client secret: Go to Certificates & secrets > New client secret. Enter a description and expiry, then click Add. Copy the secret Value immediately; it is shown only once.
Copy identifiers: From the app's Overview page, copy the Application (client) ID and Directory (tenant) ID.
Enable Azure cloud posture: To also ingest Azure subscription inventory, security assessments, and secure score, assign the Reader or Security Reader role to this app registration. In the Azure portal, open each target subscription's Access control (IAM) > Add role assignment, select the role, and assign it to the app. Repeat for each subscription.
Set up a context connector instance in Torq
Open connector setup: Go to Integrations > Context Graph > Microsoft Defender Context Connector and click Add Instance.
Configure connection details:
Name: Enter a descriptive name for the connector instance.
Tenant ID: Enter your Azure Directory (tenant) ID.
Client ID: Enter your app registration's Application (client) ID.
Client Secret: Enter the secret value copied during app setup.
Save configuration: Click Add to create the connector. Ingestion starts automatically.
You've successfully set up the Microsoft Defender context connector in Torq. With the instance configured, Torq continuously ingests device inventory into the Context Graph, along with software, logon, and advanced hunting data where permissions and licensing allow. This context is available immediately for alert enrichment in Auto Triage and for investigation in the Context Graph page.
If a permission is unavailable, Torq skips that data stream and continues ingesting the rest. Only the unavailable subset is missing; other data is unaffected.