Uploading the Britive Scripts
Britive elevates and de-elevates access by running scripts on the device through Defender live response. Each platform needs a grant (elevate) and a revoke (de-elevate) script. Upload scripts to Microsoft Defender, using the following procedure, Upload Files, leave script parameters enabled. Repeat this for every script you plan to use.
For more information, see Manage the live response file library in Microsoft Defender for Endpoint.
Note:
Script names in Britive come from the live response library, so keep the names unchanged after uploading.
Creating a Microsoft Entra App Registration
Britive connects to the Microsoft Defender for Endpoint API through a Microsoft Entra app registration. Britive supports secretless authentication for the Microsoft Defender for Endpoint WIF application.
For more information about registering the Microsoft Entra App, see Register an application.
In the Microsoft Entra admin center, go to App registrations → New registration, enter a name, and click Register.
Navigate to API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions, and add the following permissions:
Machine.Read.All: Read devices and the status of live response actions
User.Read.All: Read the users logged on to each device
Library.Manage: Read the scripts in the live response library
Machine.LiveResponse: Run the grant and revoke scripts on devices
Click Grant admin consent for <your tenant>. Every permission must show Granted. This step requires a global administrator or privileged role administrator.
Set up credentials, navigate to Certificates & secrets → Federated credentials → Add credential, choose Other issuer, and enter:
Issuer: Copy it from the Britive portal where you are creating an EPM defender. For example, <https://<your-tenant>>.britive-app.com/api/auth/sso/oauth2
Subject identifier: sys@britive.com
Audience: api://AzureADTokenExchange
Note down the following values from the app's Overview page; you need to enter those on the Endpoint Privilege Management page in Britive:
Directory (tenant) ID
Application (client) ID