This article guides you through the process of connecting Red Canary to your Microsoft Defender for Endpoint instance as part of the Active Remediation service.

The Active Remediation service requires an additional access package be created using Microsoft Identity Governance. This access package contains an elevated permissions role within a Microsoft Defender For Endpoint role which facilitates Active Remediation service capabilities.

Prerequisites

Before you configure Active Remediation, be sure you’ve connected Red Canary to Defender for Endpoint. For more information, see Connecting Red Canary to Microsoft Defender for Endpoint.

Azure: Create the Active Remediation security group

1. From your Azure portal, log in with your global administrator account.
2. Expand the navigation pane, and then click Azure Active Directory.
3. Click Groups, and then click New Group.
4. Fill in the group parameters with the following values:
• Group Type: Security
• Group Name: Red Canary Active Remediation
• Group Description: Red Canary Access Group for Active Remediation
• Azure AD roles can be assigned to the group: Yes
• Membership Type: Assigned
• Owners: No owners selected
• Members: No members selected
5. Click Create.
6. Click Yes at the confirmation prompt.

Azure: Add Red Canary as a connected organization

Note: This step is only applicable if you have not already added Red Canary as a connected organization.

1. Navigate to the Azure Active Directory, and then click Identity Governance.
2. Under Entitlement Management, click Connected organizations, and then click Add connected organization.
3. Fill out the form with the following values:
   • Name: Red Canary
   • Description: Red Canary Access Group
   • State: Configured
   1. Click Add directory + domain.
   2. Type redcanary.com into the tenant ID search bar.
   3. Highlight the entry, and then click Select.
   1. Under Add Internal Sponsor, click Add/Remove.
   2. Search for the name of your active directory administrator, highlight the account, and click Select.
• Basics
• Directory + domain
• Sponsors
4. Review the parameters, and then click Create.

Microsoft 365 Defender: Enable Role-Based Access controls in Microsoft Defender For Endpoint

1. From your Microsoft 365 Defender portal, log in with your global administrator account.
2. Click Settings, and then click Endpoints.
3. Click Roles.
4. Click Add item.
5. Fill out the form with the following values:
   • Role Name: Red Canary Active Remediation
   • Description: Red Canary Active Remediation Access Role
   • Select the following checkboxes:
     • View Data
       • • Security Operations
         • Threat and Vulnerability Management
     • Active Remediation Actions
       • • Security Operations
         • Threat and vulnerability management - Exception handling
         • Threat and vulnerability management - Remediation handling
     • Alerts Investigation
     • Live Response Capabilities
       • Advanced
6. Click Assigned user groups, and then click Red Canary Active Remediation. 
7. Click Add Selected Groups.
8. Click Save.

Microsoft 365 Defender: Grant Red Canary access to device groups

Note: Ensure that the Red Canary Active Remediation security group has been granted access to the Defender For Endpoint device groups.

This step is applicable only if there are device groups listed. By default, a device group is accessible to all users if there are no group assignments associated with the group.

1. From your Microsoft 365 Defender portal, log in with your global administrator account. 
2. Click Settings, and then click Endpoints.
3. Click Device Group.
4. Review the User Access Column in the list of Device Groups.
5. Ensure that the Red Canary Active Remediation group is listed under User Access for the group.

Azure: Create the Microsoft Azure identity governance catalog

Note: This step is only applicable if you haven't already created an Identity Governance Catalog for Red Canary.

1. From your Azure portal, log in with your global administrator account. 
2. Expand the navigation pane, select Azure Active Directory, and then select Identity Governance. 
3. Under Entitlement Management, click Catalogs, and then click New Catalog.
4. Fill out the form with the following values:
• Name: Red Canary Access
• Description: Red Canary Access Catalog
• Enabled: Yes
• Enabled for external users: Yes

Azure: Create the Microsoft Azure identity governance access packages for Active Remediation

1. From your Azure portal, log in with your global administrator account. 
2. Expand the navigation pane, and then click Azure Active Directory.
3. Click Identity Governance, Entitlement Management, and then click Catalogs. 
4. Select the Red Canary catalog.
5. Under Manage, click Access Packages, and then click New Access Package.
6. Fill out the forms with the following values:
• Basics
• Name: Red Canary Active Remediation Access Package
• Description: Red Canary Active Remediation Access
• Resource Roles
• Select Groups and Teams, Red Canary Active Remediation and then click Select.
• Important: In order to select the Red Canary Group, make sure to select See all Group and Team(s) not in the Red Canary Access catalog. You must have the correct permissions to add them in this access package.
• Under Role, click Member from the dropdown.
• Requests
• Select For users not in your directory, Specific connected organizations, and then Red Canary.
• Require Approval: No
• Enable new requests: Yes
• Lifecycle
• Access package assignments expire: Never 
• Require access reviews: Yes
• Starting on: [today's date]
• Review frequency: Bi-annually
• Duration in days: 90
• Reviewers: Specific reviewers
1. Click Add reviewers
2. Select the members of your organization responsible for IAM review procedures
7. Review the parameters, and then click Create.
8. From your Azure Portal, click Active Directory, and the click Identity Governance.
9. Click Access Packages, and then click Red Canary access package.
10. Under Properties, copy and save the My access portal link.
11. Provide the link to your Red Canary contact.

Azure: Add the security reader role to the Red Canary groups

1. From your Azure portal, log in with your Microsoft Global or Security Administrator account. 
2. Expand the navigation pane, and then click Azure Active Directory.
3. Click Groups, and then click Red Canary Active Remediation Group.
4. Click Assigned Roles, and then click Add Assignments.
5. Click the Security Reader role, and then click Add.