---
title: "Configuring Microsoft Defender for Endpoint WIF"
slug: "configuring-microsoft-defender-wif-endpoint"
updated: 2026-11-03T10:51:08Z
published: 2026-11-03T10:51:08Z
canonical: "docs.britive.com/configuring-microsoft-defender-wif-endpoint"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.britive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Microsoft Defender for Endpoint WIF

### Uploading the Britive Scripts

Britive elevates and de-elevates access by running scripts on the device through Defender live response. Each platform needs a grant (elevate) and a revoke (de-elevate) script. Upload scripts to Microsoft Defender, using the following procedure, [Upload Files](https://learn.microsoft.com/en-us/defender-endpoint/configure-libraries-live-response#upload-files), leave script parameters enabled. Repeat this for every script you plan to use.

For more information, see [Manage the live response file library in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/configure-libraries-live-response).

> [!NOTE]
> Note:
> 
> Script names in Britive come from the live response library, so keep the names unchanged after uploading.

## Creating a Microsoft Entra App Registration

Britive connects to the Microsoft Defender for Endpoint API through a Microsoft Entra app registration. Britive supports secretless authentication for the Microsoft Defender for Endpoint WIF application.

For more information about registering the Microsoft Entra App, see [Register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app).

1. In the Microsoft Entra admin center, go to **App registrations** → **New registration**, enter a name, and click **Register**.
2. Navigate to **API permissions** → **Add a permission** → **APIs my organization uses** → **WindowsDefenderATP** → **Application permissions**, and add the following permissions:
  - Machine.Read.All: Read devices and the status of live response actions
  - User.Read.All: Read the users logged on to each device
  - Library.Manage: Read the scripts in the live response library
  - Machine.LiveResponse: Run the grant and revoke scripts on devices
3. Click Grant admin consent for <your tenant>. Every permission must show Granted. This step requires a global administrator or privileged role administrator.
4. Set up credentials, navigate to **Certificates & secrets** → **Federated credentials** → **Add credential**, choose **Other issuer**, and enter:
  1. Issuer: Copy it from the Britive portal where you are creating an EPM defender. For example, <https://<your-tenant>>.britive-app.com/api/auth/sso/oauth2
  2. Subject identifier: [sys@britive.com](mailto:sys@britive.com)
  3. Audience: api://AzureADTokenExchange
5. Note down the following values from the app's Overview page; you need to enter those on the Endpoint Privilege Management page in Britive:
  - Directory (tenant) ID
  - Application (client) ID