When a security alert lands in Jira Service Management, the ticket usually says "laptop is acting weird" and the agent has to go find out which laptop, how exposed it is, and whether Defender already flagged it. If Defender's device inventory and alerts are in Assets, the requester picks the device on the form and the agent sees risk score, exposure level, health status and the open alerts on the ticket.
This article shows how to sync Microsoft Defender for Endpoint devices and alerts into JSM Assets with OnLink, reusing the Entra ID app registration you may already have for Intune or Entra ID imports.
Why put Defender data in Assets
- Incidents with context. A JSM incident raised against a Defender Device object shows riskScore, exposureLevel, healthStatus and lastSeen without a trip to the Defender portal.
- Tickets from alerts. Assets automation on a new Defender Alert object with Severity = High can create the incident, link the device and assign the security queue.
- Unprotected device triage. Devices with onboardingStatus other than Onboarded or healthStatus other than Active become a work queue for the endpoint team.
- Safer approvals. Access and change approvers see the device's risk and exposure before granting admin rights or software installs.
- One device record. Link the Defender object to the Intune, Jamf or Entra ID device you already import, by aadDeviceId or serial number, so security posture sits next to ownership and hardware.
- Reporting. AQL on devices by risk score, exposure level or device group, with history kept in Assets.
How it fits together
Two API calls become two Assets object types: Defender Device (from GET /api/machines, keyed on Machine ID) and Defender Alert (from GET /api/alerts, keyed on Alert ID, with a reference to its device). Devices import first so each alert can reference its device; on the request form the requester picks the device and the agent sees its risk, exposure and open alerts.
Authentication: reuse your Entra ID connection
The Defender API is a separate resource from Microsoft Graph, so the permissions you granted for Intune or Entra ID do not cover it. You do not need a new app registration, only two more permissions on the one OnLink already uses.
- In the Azure portal, open the app registration behind your OnLink Entra ID connection.
- API permissions → Add a permission → APIs my organization uses → search WindowsDefenderATP.
- Choose Application permissions and add Machine.Read.All (Read all machine profiles) and Alert.Read.All (Read all alerts).
- Grant admin consent.
The tenant ID, client ID and client secret stay the same. The one thing that changes is the token scope: request https://api.securitycenter.microsoft.com/.default. A Graph-scoped token, or one for api.security.microsoft.com, gets 403 Forbidden even though the calls go to api.security.microsoft.com. Microsoft's reference: Create an app to access Defender for Endpoint without a user.
One Entra ID connections can be used to pull Entra ID users, groups, Intune and now Defender for Endpoints.
GET API calls
Import | Method | Useful fields | Paging and filters |
|---|
Devices | GET /api/machines | id, computerDnsName, osPlatform, healthStatus, riskScore, exposureLevel, onboardingStatus, lastIpAddress, rbacGroupName, aadDeviceId, machineTags, lastSeen | $top up to 10,000, $skip; $filter on healthStatus, riskScore, exposureLevel, onboardingStatus, osPlatform, lastSeen, rbacGroupId, machineTags |
Alerts | GET /api/alerts | id, title, severity, status, category, detectionSource, incidentId, machineId, computerDnsName, mitreTechniques, alertCreationTime, lastUpdateTime | $top, $skip; $filter on status, severity, category, alertCreationTime, lastUpdateTime, detectionSource; $expand=evidence |
Both return { "value": [ ... ] }, so the response data path is value. Both are rate-limited to 100 calls a minute and 1,500 an hour, which a scheduled sync never approaches. /api/machines returns 404 when no device has reported inside your retention window; that is not a permission error.
OnLink mapping
Defender Device and Defender Alert, then one OnLink import for each. The left side of every line is a field in the API response; the right side is the Assets attribute.
Defender Device (key on the Defender machine id):
key:id=Machine ID
map:computerDnsName=Name
map:osPlatform=OS Platform
map:healthStatus=Health Status
map:onboardingStatus=Onboarding Status
map:riskScore=Risk Score
map:exposureLevel=Exposure Level
map:lastIpAddress=Last IP Address
map:rbacGroupName=Device Group
map:aadDeviceId=Entra Device ID
map:machineTags=Tags|arraySeparator=,
map:lastSeen=Last Seen
config:api=/api/machines
Defender Alert (key on the alert id, referencing the device by machineId):
key:id=Alert ID
map:title=Title
map:severity=Severity
map:status=Status
map:category=Category
map:detectionSource=Detection Source
map:incidentId=Incident ID
map:machineId=Device|Machine ID=${machineId}|create=false
map:mitreTechniques=MITRE Techniques|arraySeparator=,
map:alertCreationTime=Created
map:lastUpdateTime=Last Updated
config:api=/api/alerts?$filter=status ne 'Resolved'
Filters you will probably want:
Goal | Filter |
|---|
Only protected, reporting devices | $filter=healthStatus eq 'Active' and onboardingStatus eq 'Onboarded' |
A "needs attention" queue | $filter=riskScore eq 'High' or exposureLevel eq 'High' |
Drop stale devices | $filter=lastSeen gt 2026-10-01T00:00:00Z |
Open alerts only | $filter=status ne 'Resolved' |
Skip informational noise | $filter=severity in ('High','Medium') |
Run Get Data on the device import first, then Import, then the same for alerts. Schedule devices daily (Defender refreshes lastSeen about once a day) and alerts hourly. If you already sync Intune or Entra ID devices, add map:aadDeviceId=Intune Device|Entra Device ID=${aadDeviceId}|create=false to link rather than duplicate.
Try it
OnLink is a Cloud Fortified app that brings 100+ sources into JSM Assets, JSM workflows and Teamwork Graph: HR systems, identity providers, MDMs, cloud platforms and security tools like CrowdStrike, Huntress and now Defender for Endpoint. Start a free trial on the Atlassian Marketplace, or read the step-by-step guide with full mapping tables in the OnLink documentation.
FAQ
Do I need a new Entra ID app registration?
No. Add the two WindowsDefenderATP application permissions to the registration OnLink already uses and grant admin consent. Tenant ID, client ID and secret stay the same.
Why does the token request use api.securitycenter.microsoft.com when the API lives at api.security.microsoft.com?
Microsoft still issues Defender tokens for the legacy securitycenter audience. A token for any other scope returns 403 Forbidden.
Does this work with Defender for Business or Plan 1?
Yes. List machines and List alerts are available on Defender for Business and Defender for Endpoint Plans 1 and 2.
Can I import vulnerabilities or software inventory too?
Yes. The same connection serves /api/vulnerabilities, /api/software and /api/recommendations; create another object type and import for each.
What happens to alerts that get resolved in Defender?
That is your call. Without a filter they stay in Assets with a Resolved status and a resolvedTime, which is useful for audit. With status ne 'Resolved' only open alerts are imported.
