Defender for Endpoint: How isolate device with high risk automatically?

Question

Hello team,

How can I auto-isolate a device that comes with a high-risk score?

Answer 1

Hi @Sergio Londono

1. You can leverage Graph API and Power Automate to achieve auto - Isolation:
2. Acquire these permissions On your application page, select API Permissions > Add permission > APIs my organization uses > type WindowsDefenderATP and select on WindowsDefenderATP.
3. Graph Query - https://api.securitycenter.microsoft.com/api/alerts
4. Power Automate - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide#isolate-the-device-if-the-alerts-severity-is-high