Integrating with Microsoft Defender for Endpoint

Follow the steps below to integrate Microsoft Defender for Endpoint with Britive.

1. Log in to Britive with administrator privileges.

2. Click on System admin -> Endpoint Privilege Management.

3. Click on New Integration from the Endpoint Privilege Management page.

4. Click on the “+” button in front of the Microsoft Defender for Endpoint application to add a new integration.

5. Enter the following values in the Application tab:

   1. Enter the Application Name and Application Description.

   2. Select the attribute for Account Mapping to map the users in Britive with accounts in Microsoft Defender. Only one user can be mapped to an account. This is an optional field, required only for automated mapping during scanning.

   3. Select an attribute for Device Mapping to map the users in Britive with devices in Microsoft Defender. A single user can be mapped to multiple devices. Make sure to select an attribute that contains the device ID of the device. This is an optional field, required only for automated mapping during scanning.

   4. Click on Next.

6. Enter the following values in the Settings tab:

   1. API URL: Default is https://api.security.microsoft.com. Change it only for a regional or sovereign-cloud Defender endpoint.

   2. OAuth Authority URL: Default is https://login.microsoftonline.com.

   3. Entra Tenant ID, Application (Client) ID, Client Secret: Enter the values noted while Creating a Microsoft Entra App Registration.

   4. Filter for devices (included devices): Limits the scan to specific devices. The filter uses OData $filter syntax on the Defender machines API, for example, osPlatform eq 'Windows11' or startswith(computerDnsName,'lab-'). To learn more, see the Microsoft Defender for Endpoint List machines API documentation.

   5. Scan logon users for accounts: Enable to scan login history per device. If disabled, accounts are not collected.

   6. Enter the Maximum session duration for profiles under Profile Settings.

   7. Click Save and Test. A popup displays a success message if the environment is correctly configured. If any error message is displayed, review the error, correct the configuration, and test again.

7. Click on the Scan button under the Scans tab to get the details of devices (endpoints) and accounts (last logged-in user) from Microsoft Defender.

8. Click on the Data tab to check the following details added after the scan:

   1. Permissions: The live response library scripts are used to grant and revoke access. .ps1 scripts are listed under the Windows platform, and .sh scripts are listed under Linux; .sh scripts run on both macOS and Linux devices.

   2. Accounts: Last logged-in users' data from devices. Click Map/Unmap from the Action column of an account to map or unmap identity to this account.

   3. Devices: All onboarded devices, unless a filter is applied. Linux distributions (Ubuntu, Red Hat, Debian, and others) are listed under the Linux platform.

      1. Click View Details to view all details related to a device.

      2. Click Map/Unmap from the Actions column of a device to map or unmap identity to this device.

Managing Britive Profiles

After integrating Microsoft Defender for Endpoint with Britive, you can create profiles in Britive that correspond to the accounts or devices on Microsoft Defender. You can check out or check in Britive profiles to elevate access to these devices.

1. Log in to Britive with administrator privileges.

2. Click on System admin -> Endpoint Privilege Management.

3. Click on Manage for a Microsoft Defender and click on the Profiles tab.

4. Click on the Create Profile button and enter the following details to create a profile:

   1. Enter the Name and Description under the General section.

   2. Enter the Expiration Timeout and Expiration Extension (optional) under the Expiration section.

   3. Click on Done.

5. For existing or newly created profiles, enter the following details in different tabs:

   • Platform:

     1. Click on the Edit button.

     2. Select the operating system (Windows, Mac, or Linux) so the profile is offered on devices of that platform.

     3. Click on Save.

   • Permissions: Every profile must have the following permission scripts configured:

     • Grant: The script that grants access (for example, win-elevate-v3.ps1, mac-elevate-v2.sh or linux-elevate.sh).

       • Select from list: Select from a list of permission scripts.

       • Type Manually: Type the name of the permission manually.

     • Revoke: The script that revokes access (for example, win-de-elevate-v3.ps1, mac-de-elevate-v2.sh or linux-de-elevate.sh).

       • Select from list: Select from a list of permission scripts.

       • Type Manually: Type the name of the permission manually.

   • Policies: See Policies.

   • Advanced Settings: Advanced Settings

Notes:

• Checkout and check-in run through Microsoft Defender live response, so they can take a few minutes, depending on how quickly the device picks up the action. Defender also runs only one live response action per device at a time.

• On macOS and Linux, a new group membership takes effect at the user's next login session.

• The built-in local Administrator account (Windows) and root (Linux) cannot be elevated or de-elevated.