> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender XDR

> Poll Defender XDR security incidents from Microsoft Graph and triage them with identity-aware playbooks.

Clarion polls **Microsoft Defender XDR** incidents through the Microsoft Graph security API using app-only authentication, hydrates each incident with its constituent alerts, and routes it to the right scenario playbook.

<Note>
  **Estimated time:** 10 minutes. You will need a **Global Administrator** or **Privileged Role Administrator** in the Microsoft tenant to grant app-only consent.
</Note>

## Prerequisites

* A Microsoft tenant with **Defender XDR** licensed and generating incidents
* Ability to grant admin consent for application permissions in Microsoft Entra ID

## Connect

1. In Clarion, open **Integrations** and find **Microsoft Defender XDR**.
2. Click **Connect** and complete the Microsoft admin-consent flow.
3. Grant the requested **application** permissions for reading security incidents and alerts.
4. Return to Clarion; the integration appears as connected and polling begins.

<Note>
  Only workspace admins can change the connection. Members can view the integration's state.
</Note>

## What Clarion ingests

Correlated Defender XDR incidents, hydrated with their alerts so the agent sees the whole incident rather than a headline. Clarion reports **severity drift** between the incident and its alerts, and names which Microsoft products contributed.

## What agents can do

| Tool             | What it returns                       |
| ---------------- | ------------------------------------- |
| `list_incidents` | Defender XDR incidents, filterable    |
| `get_incident`   | One incident hydrated with its alerts |

## Better together with Entra

Connect [Microsoft Entra](/integrations/microsoft-entra) as well. With it, the Defender XDR agent can pivot a principal named in an incident through your directory — group membership, role assignments, sign-in risk — and carry out approved identity remediation. Without it, the agent reports and escalates rather than acting.

## Related agents

The [Microsoft Defender XDR](/learn/agents/our-agents) agent ships five skills: incident triage plus identity scenario playbooks for impossible travel, MFA and session hijacking, OAuth and app abuse, and admin compromise.

If you also run **Microsoft Sentinel**, use the combined [Microsoft Sentinel & Defender XDR](/learn/agents/our-agents) agent instead — it adds KQL hunting, phishing, endpoint forensics, ransomware scoping, Azure control-plane investigation, and UEBA anomaly analysis.

## Disconnect

Click **Disconnect** on the integration page. This removes the workspace's Clarion binding and any Defender XDR monitors under it. It does **not** revoke the Clarion application in your Microsoft tenant — do that from Entra ID if you want the consent removed.