Microsoft Defender for Endpoint WIF

Prerequisites

Complete the following prerequisites on the Microsoft Defender portal:

1. Configure the following settings in the Microsoft Defender portal from the Advanced Settings:

   • Enable live response: See «https://learn.microsoft.com/en-us/defender-endpoint/advanced-features#enable-live-response»

   • Enable live response for servers (for Windows Server devices): See «https://learn.microsoft.com/en-us/defender-endpoint/advanced-features#enable-live-response-for-servers»

   • Enable live response for unsigned script execution: See «https://learn.microsoft.com/en-us/defender-endpoint/advanced-features#allow-unsigned-script-execution-in-live-response»

2. The Britive elevates and de-elevates scripts uploaded to the Defender live response library (see Uploading the Britive Scripts).

For more information about Microsoft Defender Live Response, see Configure advanced features in Defender for Endpoint.

Configuring and Integrating Microsoft Defender for Endpoint WIF

Follow these steps to configure and integrate Microsoft Defender for Endpoint with Britive:

1. Uploading the Britive Scripts

2. Creating a Microsoft Entra App Registration

3. Integrating Microsoft Defender for Endpoint WIF with Britive