---
title: "Integrating with Microsoft Defender for Endpoint WIF"
slug: "integrating-with-microsoft-defender-wif"
updated: 2026-11-06T05:06:47Z
published: 2026-11-06T05:06:47Z
canonical: "docs.britive.com/integrating-with-microsoft-defender-wif"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.britive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrating with Microsoft Defender for Endpoint WIF

Follow the steps below to integrate Microsoft Defender with Britive.

1. Log in to Britive with administrator privileges.
2. Click on **System admin** -> **Endpoint Privilege Management**.
3. Click on **New Integration** from the **Endpoint Privilege Management** page.
4. Click on the **“+”** button in front of the **Microsoft Defender for Endpoint WIF** application to add a new integration.
5. Enter the following values in the **Application** tab:
  1. Enter the **Application Name** and **Application Description**.
  2. Select the attribute for **Account Mapping** to map the users in Britive with accounts in Microsoft Defender for WIF. Only one user can be mapped to an account. This is an optional field, required only for automated mapping during scanning.
  3. Select an attribute for **Device Mapping** to map the users in Britive with devices in Microsoft Defender. A single user can be mapped to multiple devices. Make sure to select an attribute that contains the device ID of the device. This is an optional field, required only for automated mapping during scanning.
  4. Click on **Next**.
6. Enter the following values in the **Settings** tab:
  1. **Britive Issuer URL**: This field is prefilled with your tenant's issuer; it must match the issuer in the federated credential.
  2. **API URL**: Default is *https://api.security.microsoft.com*. Change it only for a regional or sovereign-cloud Defender endpoint.
  3. **OAuth Authority URL**: Default is *https://login.microsoftonline.com*.
  4. **Entra Tenant ID** and **Application (Client) ID: Enter** the values noted while [Creating a Microsoft Entra App Registration](/v1/docs/configuring-microsoft-defender-endpoint#creating-a-microsoft-entra-app-registration).
  5. **Federated Credential Audience**: This defaults to *api://AzureADTokenExchange*; it must match the audience in the federated credential.
  6. **Filter for devices (included devices)**: Limits the scan to specific devices. The filter uses OData $filter syntax on the Defender machines API, for example, *osPlatform eq 'Windows11'* or *startswith(computerDnsName,'lab-')*. To learn more, see the [Microsoft Defender for Endpoint List machines API documentation](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines).
  7. **Scan logon users for accounts**: Enable to scan login history per device. If disabled, accounts are not collected.
  8. Enter the **Maximum session duration for profiles** under **Profile Settings**.
  9. Click **Save and Test**. A popup displays a success message if the environment is correctly configured. If any error message is displayed, review the error, correct the configuration, and test again.
7. Click on the **Scan** button under the **Scans** tab to get the details of devices (endpoints) and accounts (last logged-in user) from Microsoft Defender.
8. Click on the **Data** tab to check the following details added after the scan:
  1. **Permissions**: The live response library scripts are used to grant and revoke access. *.ps1* scripts are listed under the Windows platform, and *.sh* scripts are listed under Linux; *.sh* scripts run on both macOS and Linux devices.
  2. **Accounts**: Last logged-in users' data from devices. Click **Map/Unmap** from the **Action** column of an account to map or unmap identity to this account.
  3. **Devices**: All onboarded devices, unless a filter is applied. Linux distributions (Ubuntu, Red Hat, Debian, and others) are listed under the Linux platform.
    1. Click **View Details** to view all details related to a device.
    2. Click **Map/Unmap** from the **Actions** column of a device to map or unmap identity to this device.

## Managing Britive Profiles

After integrating Microsoft Defender for Endpoint WIF with Britive, you can create profiles in Britive that correspond to the accounts or devices on Microsoft Defender. You can check out or check in Britive profiles to elevate access to these devices.

1. Log in to Britive with administrator privileges.
2. Click on **System admin** -> **Endpoint Privilege Management**.
3. Click on **Manage** for a Microsoft Defender for Endpoint WIF application and click on the **Profiles** tab.
4. Click on the **Create Profile** button and enter the following details to create a profile:
  1. Enter the **Name** and **Description** under the **General** section.
  2. Enter the **Expiration Timeout** and **Expiration Extension** (optional) under the **Expiration** section.
  3. Click on **Done**.
5. For existing or newly created profiles, enter the following details in different tabs:
  - **Platform**:
    1. Click on the **Edit** button.
    2. Select the operating system (Windows, Mac, or Linux) so the profile is offered on devices of that platform.
    3. Click on **Save**.
  - **Permissions**: Every profile must have the following permission scripts configured:
    - **Grant**: The script that grants access (for example, *win-elevate-v3.ps1*, *mac-elevate-v2.sh* or *linux-elevate.sh*).
      - **Select from list**: Select from a list of permission scripts.
      - **Type Manually**: Type the name of the permission manually.
    - **Revoke**: The script that revokes access (for example, *win-de-elevate-v3.ps1*, *mac-de-elevate-v2.sh* or *linux-de-elevate.sh*).
      - **Select from list**: Select from a list of permission scripts.
      - **Type Manually**: Type the name of the permission manually.
  - **Policies**: See [Policies](/v1/docs/profilemgmt-managing-profiles#policies).
  - **Advanced Settings**: [Advanced Settings](/v1/docs/advanced-settings#advanced-settings)

> [!NOTE]
> Notes:
> 
> - Checkout and check-in run through Microsoft Defender live response, so they can take a few minutes, depending on how quickly the device picks up the action. Defender also runs only one live response action per device at a time.
> - On macOS and Linux, a new group membership takes effect at the user's next login session.
> - The built-in local Administrator account (Windows) and root (Linux) cannot be elevated or de-elevated.