Microsoft Defender Vulnerability Management Integration via API

Purpose

This guide explains how to register an application in Microsoft Entra ID and use its credentials in Logsign USO to pull per-device software vulnerability findings (CVE exposure, new/fixed/updated status) from Microsoft Defender Vulnerability Management via the Microsoft Defender for Endpoint REST API, for security analytics and forensic purposes.

Microsoft Defender Vulnerability Management is a cloud-only capability of Microsoft Defender for Endpoint; there is no on-premises component and no syslog export path, so this integration is a poller that calls Microsoft's REST API directly.

Prerequisites

• Access to the Azure portal (https://portal.azure.com) with permission to register an application in Microsoft Entra ID.
• Permission to grant the application the Vulnerability.Read.All application permission on the WindowsDefenderATP API (Microsoft Defender for Endpoint), and to grant admin consent for it.
• Know which regional API host your tenant should use (see Step 2); most tenants use the global default and do not need to set this explicitly.

Step 1: Register an Application in Microsoft Entra ID

1. Log into the Azure portal: https://portal.azure.com
2. Go to Microsoft Entra ID > App registrations > New registration, give the application a name (for example Logsign_DefenderVulnerabilityManagement), and click Register.
3. From the Overview page, note the Application (client) ID and Directory (tenant) ID.
4. Go to Certificates & secrets, click New client secret, and generate one. Copy the Value immediately; it cannot be retrieved again once you leave the page.
5. Go to API permissions > Add a permission > APIs my organization uses, search for and select WindowsDefenderATP (this is the API name Microsoft uses for Defender for Endpoint, including its Vulnerability Management data).
6. Choose Application permissions, select Vulnerability.Read.All, and click Add permissions.
7. Click Grant admin consent for the permission. Without this step, every call returns a 403 even though the token request itself succeeds.

Step 2: Identify Your API Host

Microsoft Defender for Endpoint exposes one global API host plus optional regional hosts. This is a fixed list from Microsoft's own documentation, not a value specific to your tenant; use the regional host only if your organization has a documented reason to (for example a data-residency requirement), otherwise leave this field blank and Logsign uses the global default.

Step 3: Configure the Integration in Logsign USO

Add a new Microsoft Defender Vulnerability Management data source in Logsign USO and provide:

What Gets Collected

Logsign polls the SoftwareVulnerabilityChangesByMachine delta endpoint, which returns one record per device/software/CVE combination that changed since the last poll, with a status of New, Fixed, or Updated. Each event carries the device ID and name, OS platform/version, the affected software vendor/name/version, the CVE ID (when the finding maps to one), severity and exploitability level, and the recommended security update where Microsoft provides one.

Notes and Limits

• Only the vulnerability change feed is implemented. Exposure score, security recommendations, and the full CVE catalog (separate Defender for Endpoint endpoints) are not collected by this integration.
• Microsoft's API accepts a sinceTime lookback of at most 14 days; Logsign clamps its polling position to this window automatically, so a source that has been disabled for longer than 14 days resumes from 14 days back rather than failing.
• Microsoft regenerates the underlying delta data approximately every 6 hours; polling more frequently than that will not surface new records sooner.
• Pagination follows the API's @odata.nextLink to completion on every poll cycle (up to 100 pages per window), so results are not capped at the first page.
• A device that changes RBAC group membership can appear twice in a single delta response (once as Fixed under its previous group, once as New under its current group); this is Microsoft's documented behavior, not a Logsign artifact.

Troubleshooting