Microsoft Defender helps detect and investigate threats. Service Automation Suite connects available Defender XDR incidents and Defender for Endpoint device data to your service desk and CMDB. Add context, assign work and track confirmed resolution according to your security procedures.
The work between your applications
Defender detects it. Who follows up?
Microsoft Defender helps detect and investigate threats. Service Automation Suite connects available Defender XDR incidents and Defender for Endpoint device data to your service desk and CMDB. Add context, assign work and track confirmed resolution according to your security procedures.
A change, request or alert
Service Automation Suite
Data, people, assets and relationships on one foundation.
Compare
What exists? What should exist?
Determine what is needed
Matrix · policy · legal requirements
Coordinate the next steps
Checks · tasks · approvals · actions
Execution ↔ feedback
Your people and tools
Microsoft DefenderMicrosoft Intune
For example. Also with other teams, suppliers and applications.
Verify. Inform. Report.
What is complete? Who needs to act? Which exception needs attention?
Start with one integration, register or check. Build on the same data and rules.
Device & CMDB Popular
Security context alongside the correct device.
Relate available Defender for Endpoint device data to your CMDB and Intune records. Show the service team which device needs attention without blindly replacing the entire inventory.
Service Automation Suite · Central coordination
Match, enrich, route and verify
Add a central register and source-of-truth rules. Check differences, request missing data and determine what gets updated.
Information & trigger
Microsoft Defender
Device & CMDB
Follow-up & feedback
Microsoft Intune
Agreed execution and confirmed outcome
Read the agreed device selection
Use device ID, Entra device ID, last seen and available risk status, for example.
Match the same record
Choose stable identifiers and define the authoritative source per field. Review uncertain or missing matches.
Enrich and verify
Add only agreed context to the CMDB or ticket. Retain its timestamp; no recent observation does not establish that a device is safe.
Security alert
From a Defender incident to focused follow-up.
Connect a relevant Defender XDR incident to a ticket in TOPdesk or HaloITSM, for example. Give the right team the available device and service context.
Service Automation Suite · Central coordination
Match, enrich, route and verify
Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.
Information & trigger
Microsoft Defender
Security alert
Follow-up & feedback
Agreed execution and confirmed outcome
Select what needs attention
Define which incidents and severity levels need follow-up. Retain tenant and incident ID to recognise subsequent updates.
Add context and assign
Match the affected device to the correct record and service. Map priority and assignment group using your rules.
Create or update the ticket
Keep new information with the same ticket and track resolution. Creating a ticket does not mean the threat is resolved.
Feedback & review
Follow-up complete. Update Defender deliberately.
Connect the security team’s confirmed assessment to the agreed Defender XDR incident status. Keep execution results and the security assessment together.
Service Automation Suite · Central coordination
Match, enrich, route and verify
Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.
Information & trigger
Feedback & review
Follow-up & feedback
Microsoft Defender
Agreed execution and confirmed outcome
Review the outcome
Define who reviews the security outcome. A closed service ticket does not automatically close a Defender incident.
Update only agreed fields
Use the available incident API for status or assignment, for example, with the required write permissions and confirmed review.
Verify the response
Record the confirmed change with the linked ticket. Assign rejected updates or discrepancies to an owner for follow-up.
Under the hood
How to connect, test and manage the integration.
For administrators who want to understand how it works: connect Microsoft Defender to your other applications, map the data and use the response in the next step. Configure it centrally in Service Automation Suite.
Agree access and application scope
Defender is a product family. XDR incidents use the appropriate Microsoft Graph Security API; device data uses the Defender for Endpoint API. We validate licences, tenant, roles, permissions and available fields per environment. Write-back requires separate permissions and rules. These are workflow examples, not a pre-tested or certified Service Automation Suite connector.
Choose the API method, URL and authentication. Manage the host and credentials in an environment. Test a request in Discovery and inspect the fields actually returned by the API.
Build the request body from validated data and inspect Body Preview before testing. Use the result ID in Data Context for the next request or save output to an entity. Configure write-back separately.
Configure error rules by HTTP code and/or message. A temporary API failure can use bounded retries. A missing relationship or rejection needs another route: record the cause and configure a verification task for the appropriate team, for example.
Which data do you maintain?
An example configuration, not fixed field names or a mandatory combination.
Alert reference and device ID
Relate the alert to the known asset and any existing ticket before creating new work.
Severity, customer and responsible group
Use shared mappings and routing rules to determine priority and follow-up.
Recovery notification and follow-up check
Return the available recovery status and separately determine whether service handling is complete.
Sent ≠ processed. Use the response and agreed validation to determine the next step.
Need to publish data yourself?
Use Endpoint Composer to publish a configured Service Automation Suite data object. Choose read and write methods and security profiles so a customer can retrieve agreed service data or a supplier can submit information, for example. Configure data selection and subsequent processing separately.
Combine the integration with a form, a shared matrix, a review or collaboration between service teams. For example, an approved request leads to execution in Microsoft Entra, a ValidSign signature request and feedback in TOPdesk. Your process determines the steps needed; not every use case requires all these components.
Start with one use case. Connect customer, employee and asset data, for example, and agree which source is authoritative. Reuse those relationships, a matrix where needed and configured actions in the next workflow. Agree who maintains the data and rules. Expand without repeatedly connecting and maintaining the same information.
Supplier finished. Is the internal work complete?
A supplier closes its ticket while internal verification or user confirmation is still missing.
Combine
Relate both tickets and the affected service. Use external completion to trigger a check, not automatically close the internal ticket.
The outcome determines what follows
Confirmed: complete internally. Rejected: return the reason and request correction. No response: assign follow-up to the agreed group.
The benefit
Fewer prematurely closed tickets and clear ownership of the next action.
A replacement laptop without losing context.
An employee receives a replacement device. The old asset, new record and open service or security tickets must remain connected.
Combine
Use the central relationship between owner and device identifiers. Combine handover, technical inventory and return with existing tickets.
The outcome determines what follows
Receipt confirmed: update ownership and relationships. Old device missing or uncertain match: start a targeted review instead of overwriting historical records.
The benefit
Current records and a traceable handover even when a management tool uses different names.
Refreshing a report does not guarantee reliable data.
A source request can succeed while data is missing, differently coded or not yet fully retrieved.
Combine
Combine pagination and output mapping with agreed data checks. Use shared relationship tables to connect sources.
The outcome determines what follows
Checks passed: prepare the dataset. Deviation: request review and expose freshness. Temporary API failures follow a bounded recovery path.
The benefit
A clearer distinction between a technically successful import and information fit for decision-making.
Your process needs more than a standard action?
Configure the missing API request, input and output in API Composer. Use its response in the next step and combine it with data tables, forms and automations. Extend the same product and reuse the configured building blocks.
Use Service Automation Suite to update a ticket in TOPdesk, for example, with fields available through its API, such as category, priority, status and support group. For another application, configure its request and field mapping. The outcome determines the next action: confirm, add information or request review, not merely check whether the request arrived.
Need to publish data or let others submit it? Endpoint Composer exposes a configured Service Automation Suite data object with selected methods and security profiles. Other building blocks handle subsequent processing.
From product to workflow
Microsoft Defender in your wider workflow
Pull up a chair. Or join us online.
Over coffee, tea or online: tell us what you are working on.
We can help with the integrations, automation and coordination your process needs, even if your application is not listed yet.
Microsoft Defender
Microsoft Intune
