Microsoft Defender

Live 23 Actions

Microsoft Defender Integration for AI Agents

Connect your AI agent to 23 Microsoft Defender actions via MCP, A2A, or SDK, with agent authentication, tool-calling execution, and security built-in.

Start Free Book Demo Microsoft Defender MCP Server

Microsoft Defender AI Agent Actions

23 production-ready actions for your agent to do more on Microsoft Defender.

Read the Microsoft Defender docs

23 Actions

List Alerts - List security alerts raised by Microsoft Defender and integrated providers.

Get Alert - Get a single security alert by its ID, including evidence and the policy that generated it.

Update Alert - Update an alert's status, classification, determination, assignee or custom details.

Create Alert Comment - Add a comment to an existing security alert.

List Analyzed Emails - List emails analyzed by Microsoft Defender for Office 365 (Threat Explorer data) within a time window.

Get Analyzed Email - Get one email analyzed by Microsoft Defender for Office 365, including verdicts, policy actions, URLs and attachments.

Remediate Analyzed Emails - Remove a threat from users' mailboxes by moving or deleting analyzed emails, or move false positives back to the inbox.

List Audit Log Queries - List unified audit log queries created in the tenant and their status.

Create Audit Log Query - Start an asynchronous search of the Microsoft 365 unified audit log.

Get Audit Log Query - Get an audit log query and its current status.

List Audit Log Records - List the audit log records returned by a completed audit log query.

List Email Threat Submissions - List emails reported to Microsoft Defender for Office 365 as spam, phishing, malware or false positives.

Get Email Threat Submission - Get a single email threat submission and its rescan result.

Create Email Threat Submission - Submit a suspected spam, phishing or malware email, or a false positive, to Microsoft Defender for Office 365.

Review Email Threat Submission - Record an administrator's review verdict on a user-reported email threat submission.

Run Hunting Query - Run a Kusto (KQL) advanced hunting query over up to 30 days of Microsoft Defender data, including email events.

List Incidents - List Microsoft Defender incidents that correlate related alerts into a single attack story.

Get Incident - Get a single Microsoft Defender incident by its ID.

Update Incident - Update an incident's status, assignee, classification, determination, severity or tags.

Create Incident Comment - Add a comment to an existing Microsoft Defender incident.

List Threat Assessment Requests - List threat assessment requests submitted to check how Microsoft's scanning judges mail, files or URLs.

Get Threat Assessment Request - Get a threat assessment request, optionally expanding its policy check and rescan results.

Create Threat Assessment Request - Submit a mail message, email file, file or URL for Microsoft to assess and report the policy result.

Do More, Build Less

Integration Infrastructure for Microsoft Defender AI Agents

Multiple Interfaces

Access integrations via API, AI SDKs, MCP & A2A.

Microsoft Defender MCP server

Managed Authentication

Pre-built authentication UI.

Agent auth

Falcon Engine

Every Microsoft Defender action runs on Falcon.

Agent Execution Engine

StackOne Defender

88.7% prompt injection detection.

Prompt injection defense

Start Free Book a Demo

"What impressed us most about StackOne is its ambition and clarity. They're creating infrastructure that modern software and the entire AI agent ecosystem can rely on. The depth of secure integrations, the pace of delivery, and the team's foresight into AI's future uniquely position StackOne to redefine this category."

Luna Schmid, Partner at GV

"We've been impressed by how quickly and deeply StackOne integrates with complex enterprise systems -- and now, with their focus on agent-to-agent interoperability, they're unlocking even more powerful use cases for customers. StackOne delivers all of the above in a universal layer -- without compromise."

Barbry McGann, SVP at Workday Ventures

Product Teams Love Building Agent Integrations With StackOne

Agentic Automation

A US medical research organisation

Case Study How a US Medical Research Organisation Connected Nine Systems to Its AI Agents in Under Two Weeks

Agentic Automation

Case Study How TYME Technologies scaled outbound 10× with agentic integrations

IAM Permissions API

Case Study How Drata Broadened User Access Review Integrations through StackOne

Connectors for workflow builders

Case Study Introist uses StackOne to Launch New Enterprise-Grade Integrations and Expand Automation for HR Teams

Agentic Connectors

Case Study How Popp Built a Recruitment AI Agent with Enterprise ATS Integration in Weeks

Scroll to explore

Microsoft Defender AI agent integration resources

Agentic Context Engineering: Why AI Agents Kill Their Own Context Windows

AI agents exceed their context windows without knowing it. Six failure patterns and seven survival architectures for agentic context engineering.

15 min

Comparing BM25, TF-IDF, and Hybrid Search for MCP Tool Discovery

Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.

10 min

Put your AI agents to work

All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.

Start Free Book Demo