Add Microsoft Defender for Endpoint

Available on: Enterprise

Firezone reads Defender for Endpoint machine inventory to check agent health, onboarding status, risk, exposure, and recent activity. Defender posture fields apply to Windows, macOS, and Linux when Firezone can match the machine to the connecting device.

Before you begin

Complete the shared prerequisites and onboard a test device to Defender for Endpoint. You need a Microsoft administrator who can grant tenant-wide consent to the Machine.Read.All application permission on WindowsDefenderATP. This permission reads the Defender machine inventory. It belongs to the Defender API, separately from Microsoft Graph permissions.

Connect Microsoft Intune as a posture provider too. Firezone matches Defender machines through the shared Entra device ID on an already matched Intune record. Defender's machine inventory does not supply a hardware serial for a direct match. A device without a matched Intune record cannot supply Defender evidence, even if Defender sync succeeds.

The Intune and Defender records must describe the same device and contain the same Entra device ID. Confirm this for every platform you intend to use, including Linux. Configure Device Trust so the initial Intune match uses an attested identity.

Add the provider

Open Settings → Device Posture → Add posture provider in Firezone and select Microsoft Defender for Endpoint.
Enter a Name for the connection and select Verify Now.
In the Microsoft window, sign in to the tenant containing your Defender machines and grant the requested admin consent.
Return to Firezone. Confirm Verified and the expected Tenant ID, then select Create. Use Reset verification if you chose the wrong tenant.
Request Sync Now from the provider's actions menu. Sync the Intune provider as well if its inventory has changed.
After Last Synced updates, open the test device's Posture tab. Confirm that both the Intune and Defender records appear and review the match badge.

The consent flow handles authorization. No customer-created app registration or client secret is required in the Firezone form.

Use Defender evidence in Policies

Follow the Policy setup steps to select the checks your devices must pass.

Check	Defender evidence
Endpoint protection active	Health is `Active` and onboarding status is `Onboarded`.
No active threats	Risk score and exposure level are both present and neither is `High`.
Recently seen	Defender last saw the machine within seven days.
OS up to date	Firezone evaluates the reported macOS release. This Defender field applies only to macOS.

No active threats uses the machine's risk and exposure values. It does not count individual Defender alerts. For a stricter requirement that accepts only low risk and low exposure, use the JSON tab.

{
  "and": [
    { "field": "defender.risk_score", "op": "is", "value": "Low" },
    { "field": "defender.exposure_level", "op": "is", "value": "Low" },
    { "field": "defender.last_seen_at", "op": "within_last", "value": "PT24H" }
  ]
}

See the Defender attribute reference for the complete field list.

Troubleshooting

If verification or syncing reports an authorization error, check the Machine.Read.All consent for WindowsDefenderATP, then reset verification and grant consent again in the intended tenant.

If the inventory syncs but no Defender record appears on a Client, first confirm the Client has a matched Intune record. Compare its Entra device ID with the Defender machine's aadDeviceId. A hostname match alone is not sufficient. Both providers must be enabled for their evidence to contribute to Policies.

If health or onboarding checks fail, inspect the machine in Defender and resolve its agent or onboarding state there. Have the endpoint report updated data, then request Sync Now in Firezone. Check last_seen_at when a healthy record still fails a freshness requirement.

Need help? See all support options.