Microsoft Defender for Endpoint

Connect Microsoft Defender for Endpoint (MDE) to Licenseware through its API. Licenseware pulls the software inventory from Defender on a schedule, so you don’t need to export or upload anything.

In Microsoft Entra, register an application. On the app Overview, copy the directory (tenant) ID and the application (client) ID. Under Certificates & secrets, create a client secret and copy the value. It is shown once.

Under API permissions, choose Add a permission, then APIs my organization uses, search for WindowsDefenderATP, add the application permission, then grant admin consent. Microsoft’s steps: Create an app to access Defender for Endpoint without a user. The list software call uses Software.Read.All (Read Threat and Vulnerability Management Software information). The per-device software inventory export uses the same permission and returns the device name with each row. The API list is Exposed APIs.

1. Open Datasources from the sidebar and click Microsoft Defender for Endpoint.
2. Click Connect. Documentation is at the top right of the source page.
3. Fill the required fields. Each one is marked with *.
   • Directory (tenant) ID
   • Application (client) ID
   • Client Secret
4. Verify connection and Save credentials stay disabled until every required field is filled. Click Verify connection first, then Save credentials.

See Data sources for how to check a connection.

Microsoft Defender for Endpoint collects endpoint and application inventory data via the Defender sensor. The relevant data sources for SIM import include:

• Devices (Machine Inventory), Device name, OS, and onboarding status.
• Software Inventory, Installed software name, version, and vendor detected per device.
• Microsoft Defender for Endpoint REST API, Programmatic access to device and software inventory data.

Note: Software inventory visibility requires Device Inventory / Software Inventory to be enabled in Microsoft Defender for Endpoint.

• Access to the Microsoft 365 Defender Portal (https://security.microsoft.com).
• Role with permission to view Endpoints and Software Inventory (e.g. Security Reader, Security Administrator).
• Devices onboarded and actively reporting to Microsoft Defender for Endpoint.
• Permission to export data from inventory views.

• Azure AD application with API permissions for Microsoft Defender for Endpoint.
• Required permissions:
  • Machine.Read.All
  • Software.Read.All
• Client ID, Tenant ID, and Client Secret for OAuth2 authentication.
• A PowerShell or REST-capable environment (PowerShell, curl, Postman).
• Access to the Defender API endpoint (https://api.security.microsoft.com).

This method is suitable for manual or ad-hoc exports.

1. Log in to the Microsoft 365 Defender Portal.
2. Navigate to Endpoints → Software inventory.
3. Apply filters as required (e.g. all devices, specific OS).
4. Ensure the following fields are visible:

• Device name
• Software name
• Version
• Vendor / Publisher

5. Click Export and choose CSV.
6. Save the file as MDE_SIM_Export.csv.

Tip: You can also export from Endpoints → Device inventory and include software-related fields in the export.

For automated or large-scale exports, use the Defender for Endpoint REST API.

# Microsoft Defender for Endpoint SIM Template Export Script
# Requires Azure AD App Registration with MDE permissions

$TenantId = "YOUR_TENANT_ID"
$ClientId = "YOUR_CLIENT_ID"
$ClientSecret = "YOUR_CLIENT_SECRET"
$ExportPath = "C:\Exports\MDE_SIM_Export.csv"

# Get OAuth2 token
$Body = @{
    grant_type    = "client_credentials"
    client_id     = $ClientId
    client_secret = $ClientSecret
    scope         = "https://api.security.microsoft.com/.default"
}

$TokenResponse = Invoke-RestMethod -Method Post `
    -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" `
    -Body $Body `
    -ContentType "application/x-www-form-urlencoded"

$AccessToken = $TokenResponse.access_token

$Headers = @{
    "Authorization" = "Bearer $AccessToken"
    "Accept"        = "application/json"
}

# Retrieve software inventory
$Url = "https://api.security.microsoft.com/api/software"
$SoftwareResponse = Invoke-RestMethod -Uri $Url -Headers $Headers -Method Get

$ExportData = @()

foreach ($Software in $SoftwareResponse.value) {
    foreach ($Device in $Software.devices) {
        $ExportData += [PSCustomObject]@{
            "Device Name"        = $Device.deviceName
            "Software Name"      = $Software.name
            "Software Version"   = $Device.version
            "Software Publisher" = $Software.vendor
        }
    }
}

# Export to CSV
$ExportData | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
Write-Host "Export complete: $ExportPath"

For large environments, handle pagination using the @odata.nextLink value returned by the API.

The CSV header row must be exactly Device Name,Software Name,Software Version,Software Publisher.

1. Open the Licenseware SIM Template.
2. Go to the Software Inventory tab.
3. Paste the CSV data into the template

Remove blank or extraneous rows before saving.

Then upload it on the SIM - Template data source. See SIM template.

Device Name,Software Name,Software Version,Software Publisher
LAPTOP-001,Google Chrome,129.0.6668.90,Google LLC
DESKTOP-04,Microsoft Teams,1.7.00.12345,Microsoft Corporation
SERVER-02,Microsoft SQL Server 2022,16.0.432,Microsoft Corporation
WS-015,Adobe Acrobat DC,24.002.20933,Adobe Inc.