'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Add Alert.Read Permissions for Microsoft Defender API
Question details
Users are unable to locate or add the Alert.Read.All and Alert.ReadWrite.All permissions for the Microsoft Defender API within Entra ID app registrations.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Configuring API permissions for a registered application to interact with Microsoft Defender for Endpoint.
- Observed behavior
- The specific alert permissions (Alert.Read.All and Alert.ReadWrite.All) are missing or not visible in the Entra ID app registrations portal.
Ensure you have Application Administrator or Global Administrator privileges in your Microsoft Entra ID tenant to modify app registration permissions.
Consult the Dedicated Microsoft Graph Forum
Because Defender API permissions are heavily integrated with Microsoft Graph, missing permission issues should be escalated directly to the official Microsoft Graph support community for targeted tenant assistance.
In many modern tenant configurations, security APIs are being consolidated under Microsoft Graph. If legacy Defender APIs or specific permissions are not populating in your app registration portal, Microsoft engineers must review your specific tenant and application setup.
Document your current setup, including the target API, application type, tenant configuration, and the permissions that are currently visible to you in the app registration.
Navigate to the official Microsoft Q&A platform specifically tagged for Microsoft Graph integration: https://learn.microsoft.com/en-us/answers/tags/161/ms-graph.
Create a new thread explaining that Alert.Read.All and Alert.ReadWrite.All are missing in Entra ID, and provide the configuration details you gathered in the first step.
Manage Your API Documentation with WPS Office
While waiting for API permission resolutions from Microsoft Support, use WPS Office as a free, lightweight alternative to Microsoft Office to draft your configurations, tenant details, and technical documentation.
- 1. Download WPS Office: Visit the official WPS website to download and install the free office suite.
- 2. Create Configuration Docs: Open WPS Writer to seamlessly draft your app registration details and API troubleshooting logs.
- 3. Save and Share: Save your document in .docx format to easily share your configuration details with Microsoft Support teams.
Frequently Asked Questions
Why are Alert.Read.All permissions missing in Entra ID?
The permissions might be hidden, deprecated in favor of unified endpoints, or require specific Microsoft Graph integration steps depending on your tenant's configuration and the specific Defender APIs you are targeting.
What admin roles are required to add API permissions in Entra ID?
You typically need the Application Administrator, Cloud Application Administrator, or Global Administrator role in Microsoft Entra ID to grant and manage API permissions for registered applications.
Can I use Microsoft Graph API instead of the Microsoft Defender API for alerts?
Yes, Microsoft has been consolidating security APIs under Microsoft Graph. You should check the Microsoft Graph Security API documentation to see if your required alert reading and writing capabilities are managed there.
