Microsoft Defender

Update your licences

This must be done during the discussion with your Stoïk sales representative, as part of the Stoïk MDR purchase. Stoïk does not purchase the licences on your behalf for Microsoft MDR.

Deploy your licences

Assigning a licence is not the same as deploying the Defender for Endpoint agent. The agent must be deployed on each device to actually enrol it, licence assignment alone does not do this.

• Endpoints (workstations): once licences are assigned, deploy Defender for Endpoint on the devices via Intune, Group Policy, or a manual script. See Microsoft's Onboarding devices documentation for the available methods.

• Servers: a dedicated licence is required. Subscribe it first via Update your licences, then deploy it using the .exe installer Microsoft provides.

Connect your Microsoft tenant to Stoïk

This is the step that links your Microsoft Defender console to Stoïk, so that alerts and hosts flow into Stoïk's investigation platform and into Stoïk Protect. The setup has three parts:

• Part A: done in a single click from Stoïk Protect (this authorises Stoïk to read alerts and hosts from your Defender tenant).

• Part B.1: invite a dedicated external user to give the Stoïk CERT team access to the Microsoft Defender portal.

• Part B.2: add XDR Defender permissions (required if Defender RBAC is enabled on your tenant).

Part A: Authorise Stoïk from Stoïk Protect

1

Log in to Stoïk Protect with your Stoïk account.

2

Go to MDR > Settings.

3

Click Connect your Microsoft account.

4

You are redirected to Microsoft. Review the permissions requested by the Stoïk MDR application and click Accept.

5

You are sent back to Stoïk Protect. The Settings page will show the connection as Connected, along with the detected Microsoft Tenant ID. Once Part A is complete, your Microsoft Defender alerts will start flowing into Stoïk. You can already see monitored hosts and alerts in Stoïk Protect > MDR.

Part B.1: Invite the Stoïk MDR user

To let the Stoïk CERT team use the Microsoft investigation console and conduct large-scale investigations on your tenant, you must invite a dedicated external user.

1

Go to portal.azure.com with an account that has Global Admin rights.

2

In the top search bar, type Users and open the user management section.

3

Click All Users, then Invite external user.

4

Fill in:

• Email address: mdr_api@stoikcert.onmicrosoft.com

• Display name: Stoik_Mdr_Api

Copy your tenant ID (displayed at step 3 of the invite form), you'll need it later.

5

Go to the Assignments tab, click Add role, search for and select Security Operator, then click Select.

If the role does not appear in the assignments list afterward, this is a known Microsoft display bug. Refresh the page, the role is usually applied correctly.

6

Click Review + invite, then Invite to finalize.

Part B.2: Add XDR Defender permissions (if Defender RBAC is enabled)

1

Go to security.microsoft.com with an account that has Global Admin rights.

2

Expand System, click Permissions, then under Microsoft Defender XDR, select Roles.

3

Click Create a custom role and fill Role Name with stoik_mdr_role.

4

Grant permissions: for each of the three permission groups, select All read and management permissions, click Apply, then Next.

5

Add the assignment:

• Click Add assignment.

• Name: stoik_mdr_assignment.

• Employees: type mdr_api@stoikcert.onmicrosoft.com and click the user icon that appears to validate.

• Select All data sources.

• Tick Include automatically all future data sources.

• Click Add, then Next.

6

Click Submit to finalize.

Notify Stoïk

Once Part B is complete, send an email to protect@stoik.io with your Microsoft Tenant ID (copied at step 4 of the previous section). The Stoïk CERT team will finalize the activation on our side.