This article guides you through the process of connecting Red Canary to your Microsoft Defender for Endpoint instance.

Estimated procedure time: 2 hours

Connect Red Canary to Microsoft Defender for Endpoint by completing these steps:

• Set up a Red Canary onboarding account.
• Set up data export from your Defender for Endpoint instance to Red Canary’s Event Hub.
• Grant Red Canary permissions to your Defender for Endpoint API.
• Grant your Red Canary team read-only access to your Defender for Endpoint console.

Prerequisites

Review the following articles before connecting Red Canary to your Microsoft Defender for Endpoint instance:

• Minimum requirements for Microsoft Defender for Endpoint
• Compare Microsoft Defender for Endpoint plans

Set up a Red Canary onboarding account

Before beginning the onboarding process, you must provide Red Canary with the name and email address for an account with global administrator privileges within your Azure organization. You’ll use this account throughout the onboarding process.

If you already have a global administrator account, follow these steps:

1. Provide the name and email address of the account to your Red Canary contact.
2. Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, notify your Red Canary contact, who will provide you with an invitation link.
   Note: When logging in to this site, you should be prompted to accept certain permissions. If you do not see this permissions page on your first login, try accessing this link via an incognito or private window.

If you don’t have a global administrator account, follow these steps:

1. Log in to your Azure tenant at https://portal.azure.com.
2. Create a new user by following the steps in Add or delete users using Azure Active Directory.
3. Assign “Global Administrator” or “Security Administrator” to the new user by following the steps in Assign administrator and non-administrator roles to users with Azure Active Directory.
4. Confirm that permissions are correct by logging into Azure, searching for the new user, and validating that the user belongs to the “Global Administrator” or “Security Administrator” role.
5. Provide the name and email address of the account to your Red Canary contact.
6. Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, you can accept the invitation by logging in to https://portal.azure.com/microsoft-production.redcanary.co.

Set up data export (Streaming API)

After you configure your onboarding account, you can set up data export from your Defender for Endpoint instance to Red Canary’s Event Hub. This configuration instructs the Defender for Endpoint platform to begin sending your telemetry to Red Canary for processing.

To set up data export:

1. Log in to Microsoft Defender Security Center using your global administrator account.
2. Navigate to Settings, Microsoft 365 Defender, and then select Streaming API.
3. Click + Add.
4. Please name the export “MXDRPartner-{ Your Company Name}”
5. Click Forward events to Event Hub.
6. Fill in the values of Event-Hub Resource ID and Event-Hub name using the credentials Red Canary has provided to you via email.
7. Select all Event Types.
8. Click Submit. It will take 30 min to 4 hours after the final step is completed before the data stream is established within Red Canary.

For a walkthrough of these steps, review this video:

Grant permissions to your Microsoft Defender for Endpoint API

After you configure your onboarding account, you can grant Red Canary permissions to your Defender for Endpoint API. This enables the Red Canary platform to retrieve alerts, process endpoint metadata, and orchestrate actions on endpoints.

To grant permissions to your Microsoft Defender for Endpoint API:

1. Log in to your global administrator Microsoft account.
2. Approve permissions for Red Canary API integration by clicking this link: https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=69561a74-a59d-43f4-a113-8bc2da00f822&response_type=code&sso_reload=true

Grant Red Canary analysts read-only access to your Microsoft Defender console

After you grant permissions to your Microsoft Defender for Endpoint API, you can give Red Canary read-only access to your Defender for Endpoint console using role-based access control; see Manage portal access using role-based access control in Microsoft Docs for more information. This enables your Red Canary teams, such as your incident handling and detection engineering teams, to perform ad-hoc hunting and investigation of potential threats in your environment.

Note: This process requires an Azure AD Premium P2 license. If you have an Azure AD Premium P1 license, see P1 Azure License - Granting Red Canary analysts read-only access to Microsoft Defender in the Red Canary Help Center.

For a guided walkthrough of these steps, review this video.

First, prepare your Microsoft Azure group for Role-Based Access Control, and link the Red Canary active directory tenant:

1. Navigate to https://portal.azure.com, and log in with your global administrator account.
2. Expand the navigation pane, and then select Azure Active Directory | Groups | New Group.
3. Fill in the group parameters with the following values:
   • • Group Type: Security
     • Group Name: Red Canary
     • Group Description: Red Canary Access Group
     • Azure AD roles can be assigned to the group (Preview): Yes
     • Membership Type: Assigned
     • Owners: No owners selected
     • Members: No members selected
4. Click Create, and then click Identity Governance.
5. Under Entitlement Management, select Connected organizations, and then Add connected organization.
6. Fill out the form with the following values:
   • • Basics
       • • Name: Red Canary
         • Description: Red Canary Access Group
         • State: Configured
     • Directory + domain
       1. 1. Click Add directory + domain.
          2. Type redcanary.com into the tenant ID search bar.
          3. Highlight the entry, and click Select.
     • Sponsors
       1. 1. Under Add Internal Sponsor, click Add/Remove.
          2. Search for the name of your active directory administrator, highlight the account, and click Select.
7. Review the parameters, and then click Create.

Next, enable Role-Based Access Controls in Microsoft Defender for Endpoint:

1. Navigate to https://security.microsoft.com, and log in with your global administrator account. 
2. Select Settings | Endpoints | Roles | Add item.
3. Fill out the form with the following values:
   • • Role Name: Red Canary
     • Description: Red Canary Access Role
     • Check the following boxes:
       • • View Data
           • • Security Operations
             • Threat and Vulnerability Management
         • Active Remediation Actions
           • • Security Operations
             • Threat and vulnerability management - Exception handling
             • Threat and vulnerability management - Remediation handling
         • Alerts Investigation
         • Live Response Capabilities
           • • Basic
4. Click Assigned user groups, Red Canary, and then Add Selected Groups.
5. Click Save.

Finally, configure your Microsoft Azure Identity Governance Access Packages:

1. Navigate to https://portal.azure.com and log in with your global administrator account. 
2. Expand the navigation pane, and then select Azure Active Directory | Identity Governance. 
3. Under Entitlement Management, select Catalogs, and then New Catalog.
4. Fill out the form with the following values:
   • • Name: Red Canary Access
     • Description: Red Canary MTP Service Access Catalog
     • Enabled: Yes
     • Enabled for external users: Yes
5. Under Entitlement Management, select Access Package, and then New Access Package.
6. Fill out the forms with the following values:
   • • Basics
       • • Name: Red Canary Access Package
         • Description: Red Canary Access
         • Catalog: Red Canary Access
     • Resource Roles
       • • Select Groups and Teams | Red Canary | Member | Select.
           • Important: in order to select the Red Canary Group, make sure to select See all Group and Team(s) not in the Red Canary Access catalog. You must have the correct permissions to add them in this access package.
     • Requests
       • • Select For users not in your directory, Specific connected organizations, and then Red Canary.
         • Require Approval: No
         • Enable new requests and assignments: Yes
     • Lifecycle
       • • Access package assignments expire: Never 
         • Require access reviews: Yes
         • Starting on: [today's date]
         • Review frequency: Bi-annually
         • Duration in days: 90
         • Reviewers: Specific reviewers
           1. 1. Click Add reviewers. 
              2. Select the members of your organization responsible for IAM review procedures.
7. Review the parameters, and then click Create.
8. Select the newly created access package under Azure Portal | Active Directory | Identity Governance | Access Packages | Red Canary.  
9. Under Properties, copy the “My access portal link.”
10. Provide the link to your Red Canary contact.

What if my organization uses device groups?

If your organization uses device groups, add permissions by completing the following steps:

1. Navigate to https://security.microsoft.com and log in with your global administrator account.
2. Select Settings | Endpoints | Device Groups.
3. Navigate to ​Assigned User Groups.
4. Select the Red Canary group previously created in Azure AD. Add that group to Azure AD user groups with this role, and click​ Save.
5. Go to Settings | Permissions | Machine Groups.
6. Click on a machine group name.
7. From User Access, select the checkbox to grant access to the ​Red Canary ​group.
8. Repeat steps 6 and 7 for all machine groups.