Create multiple instances for the Microsoft Defender Mitigation Control Integration
You can configure multiple instances for the Microsoft Defender Mitigation Control Integration.
Before you begin
Roles required:
- SPC Admin Group and SPC Analyst Group for configuration of new integration instances in the workspace
Microsoft SCCM credentials that include the Script Authors role. The Script Authors role provides required permissions to create a script that is required to import mitigation information on the SCCM server.
Note: This role must be created and assigned with the following permissions:
Category Permission State Collection Run Script No Site Read Yes SMS Scripts Create Yes SMS Scripts Read Yes SMS Scripts Delete Yes SMS Scripts Modify Yes Microsoft SCCM credentials that include the Script Approvers role. The script created to import mitigation information requires approval in your Microsoft SCCM console by user with the Script Approvers role.
Note: This role must be created and assigned with the following permissions:
Category Permission State Collection Run Script No Site Read Yes SMS Scripts Read Yes SMS Scripts Approve Yes SMS Scripts Modify Yes
Procedure
Navigate to Connectors and use cases setup > SPC API Integrations.
Select New.
The New Defender instance modal is displayed.
Enter a name for your new instance and select Create instance.
The SPC API Integrations page is displayed with the instance provided with the application and your new instance.
Select the link for your new instance.
Fill out the fields in the SCCM credentials configuration modal for your new instance.
| Field | Description |
|---|---|
| Name | Field is populated automatically with the instance name. |
| Connection | Create a new connection.1. Select Create Connection and Alias at the top of the modal. 2. In the Connection and Credential Aliases form, fill out the mandatory fields.
The page refreshes and related links and tabs are displayed at the bottom of the page after you save it.
The Connection form is displayed. Fill out the fields.
|
| Host | This is the Host for the SCCM server referenced from the Host field after you save it on the Connection page as described above. |
| User name | This is the user name referenced from the Username field after you save it on the Connection page as described above. |
| Password | This is the password referenced from the Password field after you save it on the Connection page as described above. |
| MID Server | This is the MID Server referenced from the MID Server fields after you save it on the Connection page as described above. |
| Validation status | Field populated after validation attempt. If the connection successful, the integration instance state is Valid. |
| SG connector connection | Select one Connection and Credential Aliases option from the list for the Service Graph Connector for Microsoft SCCM. You set this connection up during the Guided Setup steps for Microsoft SCCM SGC. |
| Validation detail | Details about the validation attempt. |
Navigate to Connectors and use cases setup > SPC API Integrations.
Select the link for your new instance.
In the SCCM credentials configuration modal, select the connection from the list that you created in step 5 for the Connection field.
Note that the fields listed below are auto-populated based on the information you entered for your new connection.
Host This is the Host for the SCCM server referenced from the Host field after you save it on the Connection page as described above. User name This is the user name referenced from the Username field after you save it on the Connection page as described above. Password This is the password referenced from the Password field after you save it on the Connection page as described above. MID Server This is the MID Server referenced from the MID Server fields after you save it on the Connection page as described above. Validation status Field populated after validation attempt. If the connection successful, the integration instance state is Valid. SG connector connection Select one Connection and Credential Aliases option from the list. Validation detail Details about the validation attempt. Select Save and Test Credentials.
A
Validresponse for a successful connection is required to proceed to the next step.Select Next.
The PowerShell script is created as described in Install and configure the Service Graph Connector for Microsoft SCCM and the Microsoft Defender Mitigation Control Integration. Follow the steps in that topic to approve the scripts for your new instances.