# Microsoft 365 / Microsoft Defender

## Microsoft 365 / Microsoft Defender

The Dropzone AI platform integrates with Entra ID, Exchange Online, and Microsoft Defender via the Microsoft Graph API. The MS Remediator integration allows Dropzone to initiate Containment Actions during investigations. See the [Remediator](https://docs.dropzone.ai/overview/remediator-automaticcontainment) documentation for more information.

## Integrations Overview

To enable these integrations, you must perform the following actions:

* Register a new application in Microsoft Entra Admin Center
* Locate your Client ID, Tenant ID, and create a Client Secret
* Enable Dropzone Certificate Credentials
* Assign necessary API permissions to the application

See the [Microsoft 365 Data Source](https://docs.dropzone.ai/integrations/data/ms/ms365) page for instructions on how to complete these actions.

### Enable Microsoft 365/Microsoft Defender

To enable the Remediator integration, you'll need the following information:

| Dropzone Field | Source                                           |
| -------------- | ------------------------------------------------ |
| Client ID      | The "Application (client) ID" you copied earlier |
| Tenant ID      | The "Directory (tenant) ID" you copied earlier   |
| Client Secret  | The client secret "value" you copied earlier     |

To enable the Remediator integration, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

<figure><img src="/files/zN02u3HObDaemUY8E1kD" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Available" (or, if already integrated, click "Connected")

<figure><img src="/files/brI7n2Ux40Tk0jTwBCVh" alt=""><figcaption><p>Click Available</p></figcaption></figure>

* In the Search bar, search MS 365/Defender, then click "Configure"

<figure><img src="/files/PPFAKUr9HhU3pWHSgJfh" alt=""><figcaption><p>The Microsoft 365/Defender Source Tile</p></figcaption></figure>

* Under the Remediator heading, input the Client ID, Tenant ID, and Client Secret
* In the "Available Containment Actions" section, check the Containment Actions you wish to enable Dropzone to perform

<figure><img src="/files/yPTRNbQ8tJaxTGbOfDcj" alt=""><figcaption><p>Configure the Remediator Integration</p></figcaption></figure>

* Click "Test & Save" to finish

{% hint style="warning" %}
Dropzone does not test that your permissions have been configured correctly when running Remediator Containment Actions. Be sure to double check that your configuration is correct and up to date.
{% endhint %}

If you have any errors engage your Dropzone AI support representative.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.dropzone.ai/integrations/remediator/ms365_remediator.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.