Clarion polls Microsoft Defender XDR incidents through the Microsoft Graph security API using app-only authentication, hydrates each incident with its constituent alerts, and routes it to the right scenario playbook.
Estimated time: 10 minutes. You will need a Global Administrator or Privileged Role Administrator in the Microsoft tenant to grant app-only consent.
Prerequisites
- A Microsoft tenant with Defender XDR licensed and generating incidents
- Ability to grant admin consent for application permissions in Microsoft Entra ID
Connect
- In Clarion, open Integrations and find Microsoft Defender XDR.
- Click Connect and complete the Microsoft admin-consent flow.
- Grant the requested application permissions for reading security incidents and alerts.
- Return to Clarion; the integration appears as connected and polling begins.
Only workspace admins can change the connection. Members can view the integration’s state.
What Clarion ingests
Correlated Defender XDR incidents, hydrated with their alerts so the agent sees the whole incident rather than a headline. Clarion reports severity drift between the incident and its alerts, and names which Microsoft products contributed.
What agents can do
Better together with Entra
Connect Microsoft Entra as well. With it, the Defender XDR agent can pivot a principal named in an incident through your directory — group membership, role assignments, sign-in risk — and carry out approved identity remediation. Without it, the agent reports and escalates rather than acting.
The Microsoft Defender XDR agent ships five skills: incident triage plus identity scenario playbooks for impossible travel, MFA and session hijacking, OAuth and app abuse, and admin compromise.
If you also run Microsoft Sentinel, use the combined Microsoft Sentinel & Defender XDR agent instead — it adds KQL hunting, phishing, endpoint forensics, ransomware scoping, Azure control-plane investigation, and UEBA anomaly analysis.
Disconnect
Click Disconnect on the integration page. This removes the workspace’s Clarion binding and any Defender XDR monitors under it. It does not revoke the Clarion application in your Microsoft tenant — do that from Entra ID if you want the consent removed. 
