Defender API Endpoint Migration - 403 Errors with New Base URL

Question

Issue Summary:

We're experiencing 403 permission errors when switching from the legacy Defender API endpoint

(https://api.securitycenter.windows.com) to the new documented endpoint (https://api.security.microsoft.com) for our

ThreatStream integration.

Background:

We maintain an integration between Anomali ThreatStream and Microsoft Defender for Endpoint. We were referred to Microsoft Support

Current State:

• Legacy endpoint (https://api.securitycenter.windows.com): Working without issues
• New endpoint (https://api.security.microsoft.com): Returns 403 errors
• Error message: Indicates missing permissions
• App registration permissions: Already configured with required Defender API permissions

Questions:

1. Is https://api.security.microsoft.com the official replacement for https://api.securitycenter.windows.com?
2. If yes, is there a migration timeline or deprecation date for the legacy endpoint?
3. Are there additional permissions or configuration changes required for the new endpoint beyond what was needed for the legacy

endpoint?

4. Does the Advanced Hunting API migration to Microsoft Graph (documented here) affect standard Defender API calls?

Request:

Please confirm the correct endpoint and any additional steps needed to migrate from the legacy Defender API endpoint to the new

one without permission errors.

Answer 1

Michael Spence Yes, https://api.security.microsoft.com is the official and current base endpoint for Microsoft Defender for Endpoint APIs. The legacy endpoint https://api.securitycenter.windows.com is still functional for backward compatibility, but Microsoft recommends using the new endpoint going forward. At this time, no formal deprecation date has been announced for the legacy endpoint.

Regarding the 403 permission errors, no additional Defender API permissions are required beyond what was previously used. The issue is typically caused by the OAuth token being requested for the old resource audience. When calling the new endpoint, the access token must be obtained using the following scope:

https://api.security.microsoft.com/.default

If the token is still issued for https://api.securitycenter.windows.com, the new endpoint will reject the request with a 403 error, even though the permissions are correctly configured.

The Advanced Hunting API migration to Microsoft Graph only affects Advanced Hunting queries and does not impact standard Defender for Endpoint APIs (alerts, machines, indicators, actions, etc.). Standard Defender API calls continue to work through api.security.microsoft.com.

Summary / Required Action:

• Use https://api.security.microsoft.com as the base URL
• Update the token request scope to https://api.security.microsoft.com/.default
• No permission changes are required
• Advanced Hunting migration to Microsoft Graph is separate and does not affect standard APIs

This should resolve the permission errors when migrating from the legacy endpoint.