Uploading the Britive Scripts
Britive elevates and de-elevates access by running scripts on the device through Defender live response. Each platform needs a grant (elevate) and a revoke (de-elevate) script. Upload scripts to Microsoft Defender, using the following procedure, Upload Files, leave script parameters enabled. Repeat this for every script you plan to use.
For more information, see Manage the live response file library in Microsoft Defender for Endpoint.
Note:
Script names in Britive come from the live response library, so keep the names unchanged after uploading.
Creating a Microsoft Entra App Registration
Britive connects to the Microsoft Defender for Endpoint API through a Microsoft Entra app registration. Britive supports client secrets as an authentication method for the Microsoft Defender for Endpoint application.
For more information about registering the Microsoft Entra App, see Register an application.
In the Microsoft Entra admin center, go to App registrations → New registration, enter a name, and click Register.
Navigate to API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions, and add the following permissions:
Machine.Read.All: Read devices and the status of live response actions
User.Read.All: Read the users logged on to each device
Library.Manage: Read the scripts in the live response library
Machine.LiveResponse: Run the grant and revoke scripts on devices
Click Grant admin consent for <your tenant>. Every permission must show Granted. This step requires a global administrator or privileged role administrator.
Set up credentials, navigate to Certificates & secrets → Client secrets → New client secret, and copy the secret value.
Note down the following values from the app's Overview page; you need to enter those on the Endpoint Privilege Management page in Britive:
Directory (tenant) ID
Application (client) ID
Client secret (client secret method only)