> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/cloud-log-forwarding/azure-microsoft/microsoft-defender-atp/assign-permissions-to-the-windowsdefenderatpsiemconnector-application.md).

# Assign permissions to the WindowsDefenderATPSiemConnector application

1\.     Log in to the Microsoft Azure Portal at[ https://portal.azure.com](https://portal.azure.com/) with a user account that has either the Application Administrator or Global Administrator Role assigned.

2\. Type App registrations in the Search bar.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgssON9tH6-oPHaL7Wx%2Fimage.png?alt=media\&token=2d67734a-d215-47fa-b918-52e713639cec)

3\. Click App Registrations in the search results.

4\. Click All applications on the App registrations page

\ <br>

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsuCGPgZzAkAZTf28K%2Fimage.png?alt=media\&token=98a9be26-959c-4d2b-bbee-88efb1aecbce)

5\. Select WindowsDefenderATPSiemConnector from the Application list.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsuOgzQabHm-Zn_vXs%2Fimage.png?alt=media\&token=7a09ef55-2ef1-4611-8ba5-08b9f21e8ee6)

6\. Select A  PI permissions from the left-hand menu.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsuRwqGFwVr7JnZtNZ%2Fimage.png?alt=media\&token=2676d1d7-8d28-4280-ab26-5bda06b4c2e5)

7\. Click the Add a permission button.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsuXmWMr7BDm3eIgpu%2Fimage.png?alt=media\&token=37e1c9b6-f110-4a08-94b6-c4d4d4d63b8d)

8\.  Select the APIs my organization uses tab on the Request API permissions fly-out.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-Mgsu_epJxT-AdHFdL_f%2Fimage.png?alt=media\&token=2de01686-72d6-430d-904d-d0140c8fcad9)

9\. Type **W** **indowsDefender** in the Search field.

10\. Select WindowsDefenderATP from the search results.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-Mgsuo9CavWfyEPQtw50%2Fimage.png?alt=media\&token=a3446cd8-f1b5-40db-b6b1-126134246627)

11\. Select the Delegated permissions category.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-Mgsuw0bNbTeYPSekzIL%2Fimage.png?alt=media\&token=478a3943-5449-419b-87e3-fb791cb54f49)

12\. Expand the AdvancedQuery permission and select the AdvancedQuery.Read checkbox.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-Mgsv-Km__p5CF6ge_-E%2Fimage.png?alt=media\&token=79704f21-9562-440e-a417-ca1c820ff2c9)

13\. Select the Application permissions category.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsvUmHLFTZUMez_9ul%2Fimage.png?alt=media\&token=bfbc181c-4cd6-467b-8a0e-a5038cb81914)

14\. Expand the AdvancedQuery permission and select the AdvancedQuery.Read.All checkbox.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsvXgDb0iXy0xl6crV%2Fimage.png?alt=media\&token=7f50de36-ada3-480f-a2e8-528954dd04ef)

15\.          Expand the Alerts permission and select the Alert.Read.All checkbox.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-Mgsv_DPL68W1Sboba95%2Fimage.png?alt=media\&token=1f82e9ab-7eac-4ba4-96bd-ddb07181e3f3)

16\. Expand the Machine permission and select the Machine.Read.All checkbox.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgsvbguPArMJpVv0pfM%2Fimage.png?alt=media\&token=e3026564-7f1b-4b3a-a7a4-239feffaf21c)

17\. Click the Add permissions button.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-Mgsve4q0X6vIbXJoAKr%2Fimage.png?alt=media\&token=13f50772-90db-489b-9eca-93dcc7782c60)

\
18\. Click the Grant admin consent for… button.

![](https://2078222076-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMRHZBPHlLDUc8519fX%2F-Mgsqt-sKNhRxzmwWYot%2F-MgswE-ivdjbCIwWZo5u%2Fimage.png?alt=media\&token=251aa878-755e-41e7-bd4c-21c33435550f)

##