Endpoint Detection and Response (EDR) Integration
Microsoft Defender detections on your phone
PocketSOC connects to Microsoft Defender for Endpoint (MDE) through a tenant-scoped Azure app registration. SOC responders can view MDE alerts, inspect machine details, and isolate or unisolate compromised machines directly from iOS or Android. Authentication uses Application or Delegated permissions on the MDE API — your administrators control scope.
A high-severity Defender for Endpoint alert fires while you are away from your desk. Your phone gets the push, you open the alert — machine details, risk score, alert timeline — and make the call. If the machine is compromised, you isolate it from your phone. No laptop, no VPN, no portal login.
Supported actions for Defender for Endpoint
- View Microsoft Defender for Endpoint alerts with full context
- Inspect affected machine details and risk score
- Isolate a machine to contain an active threat
- Lift (unisolate) a machine once the investigation closes
- Receive push notifications for new alerts above a severity threshold
- Filter alerts by status, severity, and machine group
Authentication and credentials
Microsoft Defender for Endpoint uses an Azure app registration. PocketSOC supports both Application permissions (daemon-style, suitable for shared service identities) and Delegated permissions (per-user, with the signed-in user's permissions enforced). For free viewing, the read scopes Alert.Read.All and Machine.Read.All are sufficient; grant Alert.ReadWrite.All and Machine.ReadWrite.All only if you use Pro response actions such as isolation or alert updates. Admin consent is required. Credentials live in platform-native secure storage on each device.
How PocketSOC authenticates to security platforms · Where credentials are stored · Trust Center
Connect Defender for Endpoint in about 2 minutes
Create an app registration in Microsoft Entra, grant read permissions on the MDE API, and paste the Tenant ID, Client ID, and Client Secret into PocketSOC. Viewing is free, and read scopes (Alert.Read.All, Machine.Read.All) are all you need to start — add the ReadWrite variants later only if you adopt Pro response actions.
- In Azure Portal, go to App registrations → New registration
- Choose Application or Delegated permissions
- Assign Alert.Read.All and Machine.Read.All on the MDE API (ReadWrite variants only if you use Pro response actions)
- Grant admin consent
- Create a client secret; copy Tenant ID, Client ID, and Client Secret
- In PocketSOC, paste Tenant ID, Client ID, and Client Secret to connect
See the full Quick Start guide for Organization-mode setup with the PocketSOC Portal.
Free vs Pro
Free — unlimited viewing
- Unlimited viewing of Defender for Endpoint alerts
- Full alert detail with machine context and risk score
- Cross-vendor correlation across your connected platforms
- Your first connected vendor profile
Pro — take action
$9.99/month or $99.99/year, with a 7-day free trial.
- Isolate machines and lift isolation
- Assign, close, and set disposition on alerts
- Cross-vendor containment
- Push notifications for new alerts
- Additional vendor connections
See full pricing and plans including Organization mode for teams.
Your credentials stay on your device
In Personal Use mode, your Microsoft API credentials are stored in the device Keychain and every API call goes directly from your phone to Microsoft's API. Requests never route through PocketSOC servers — there is no proxy or relay in the data path. Read how we verify that claim on the Security & Architecture page.
Defender for Endpoint integration FAQ
Application or Delegated permissions — which should we use?
Application permissions work like a daemon: any user with valid PocketSOC credentials can perform any allowed action. Use Application for team-wide shared visibility.
Delegated permissions enforce the signed-in user's permissions on every request. Use Delegated when you want individual analysts to take actions only as themselves, with full attribution in Azure audit logs.
Is Defender for Endpoint fully supported?
Yes. PocketSOC authenticates to MDE, fetches alerts, shows full details, and performs isolation and unisolation where the configured role allows it. See the platforms FAQ entry.
Where are Defender credentials stored?
Tenant ID, Client ID, and Client Secret are encrypted in transit and stored in iOS Keychain or Android Keystore on each device. PocketSOC servers do not retain raw secrets in logs. See the credentials storage FAQ.
Can we limit which actions analysts can perform?
Yes — scope is enforced at the Azure app registration. If the app has read-only Alert permissions, PocketSOC will display alerts but disable any write actions. With Delegated permissions, each user's individual role inside MDE further constrains what they can do.
See the full PocketSOC FAQ covering all vendors and security topics.