This plugin integrates with Microsoft Defender for Endpoint to retrieve all SSL/TLS certificates discovered across enrolled Windows devices. For each certificate, it captures key metadata, including the subject, issuer, validity period, key usage, and the associated device.

Note: Microsoft Defender does not provide access to the raw certificate data. Therefore, this plugin records certificate attributes only and does not store the complete certificate content.

Before You Start

To configure access, ensure you have the following details from Microsoft Entra ID:

  • Tenant ID – Identifies your organization within Entra ID
  • Client ID – Identifies the application registered to access the API
  • Client Secret – Acts as the authentication credential (password) for the application

Setting Up Microsoft Entra ID Access

Step 1: Register an Application

  1. Sign in to the Azure Portal.
  2. Navigate to Microsoft Entra ID → App registrations → New registration.
  3. Provide a name for the application (for example, Entrust-Discovery-MsDefender), then click Register.
  4. From the Overview page, copy the following values:
    • Directory (tenant) ID
    • Application (client) ID

Step 2: Create a Client Secret

  1. Open the newly created app registration.
  2. Go to Certificates & Secrets → New client secret.
  3. Enter a description and select an expiry period.
  4. Click Add.
  5. Copy the Value immediately, as it is displayed only once.

Step 3: Grant API Permissions

  1. Navigate to API permissions → Add a permission → APIs my organization uses.
  2. Search for and select WindowsDefenderATP.
  3. Choose Application permissions and enable:
    • Vulnerability.Read.All
  4. Click Add permissions.
  5. Select Grant admin consent (this step requires Entra ID administrator privileges).

Once admin consent is successfully granted, the application is fully configured and ready for use.