Microsoft Defender XDR
Bring Microsoft Defender XDR incidents into the security signal inbox, where a person decides what becomes an Aegis incident.
At a glance
| Direction | Into Aegis. |
|---|---|
| What it brings in |
Defender XDR incidents, with their related alerts grouped. A
connection authorised before
SecurityIncident.Read.All was granted falls back to
single alerts and asks you to re-authorise.
|
| Where it lands |
The security signal inbox (/incidents/signals). A sync
never creates an incident: a reviewer accepts, merges or dismisses
each signal (see
Incidents).
|
| Credentials and permissions |
An app registration in your Microsoft Entra ID tenant with the
delegated Microsoft Graph permissions
SecurityAlert.Read.All,
SecurityIncident.Read.All and
User.Read and admin consent, then
Authorize with Microsoft.
|
| Owner of imported records | A signal has no owner. The incident created when a reviewer accepts it belongs to that reviewer. |
| When it runs |
On demand with the sync button, or on a schedule under
Sync Settings (see
Connectors).
|
| Set it up |
/connectors/azure, by people allowed to configure
connectors, on a plan that includes the connector.
|
Good to know
- Signals already in the inbox, or already imported as incidents, are not offered twice.
- Nothing is dismissed automatically, not even alerts Defender already resolved; Aegis only suggests keep, merge or dismiss.
Where this connects
The shared Microsoft setup steps are in Connectors; the inbox is described in Incidents.