Edit

Share via

Troubleshoot Microsoft Defender XDR service issues

  • Article
  • Applies to:
    Microsoft Defender XDR

This article addresses issues that might arise as you use the Microsoft Defender XDR service. It provides solutions and workarounds to help you resolve these issues. If you encounter a problem that isn't addressed here, contact Microsoft Support.

I don't see Microsoft Defender XDR content

If you don't see capabilities on the navigation pane such as the Incidents, Action center, or Hunting in your portal, you need to verify that your tenant has the appropriate licenses.

For more information, see Prerequisites.

Microsoft Defender for Identity alerts are not showing up in the Microsoft Defender XDR incidents

If you have Microsoft Defender for Identity deployed in your environment but you're not seeing Defender for Identity alerts as part of Microsoft Defender XDR incidents, you need to ensure that the Microsoft Defender for Cloud Apps and Defender for Identity integration is enabled.

For more information, see Microsoft Defender for Identity integration.

My legitimate file/URL is being detected as malicious

A false positive is a file or URL that is detected as malicious but isn't a threat. You can create indicators and define exclusions to unblock and allow certain files/URLs. See Address false positives/negatives in Defender for Endpoint.

My ServiceNow tickets are no longer available in the Microsoft Defender portal

The Microsoft Defender XDR-ServiceNow connector is no longer available in the Microsoft Defender portal. However, you can still integrate Microsoft Defender XDR with ServiceNow by using the Microsoft Security Graph API. For more information, see Security solution integrations using the Microsoft Graph Security API.

The Microsoft Defender XDR-ServiceNow integration was previously available in the Microsoft Defender portal for preview and feedback. This integration allowed you to create ServiceNow incidents from Microsoft Defender XDR incidents.

I can't submit files

In some instances, an administrator block might cause submission issues when you try to submit a potentially infected file to the Microsoft Security intelligence website for analysis. The following process shows how to resolve this problem.

Review your settings

Open your Azure Enterprise application settings. Under Enterprise Applications > Users can consent to apps accessing company data on their behalf, check whether Yes or No is selected.

  • If No is selected, a Microsoft Entra administrator for the customer tenant needs to provide consent for the organization. Depending on the configuration with Microsoft Entra ID, users might be able to submit a request right from the same dialog box. If there's no option to ask for admin consent, users need to request for these permissions to be added to their Microsoft Entra admin. Go to the following section for more information.

  • If Yes is selected, ensure the Windows Defender Security Intelligence app setting Enabled for users to sign in? is set to Yes in Azure. If No is selected, you need to request a Microsoft Entra admin enable it.

Implement required Enterprise Application permissions

Important

Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.

This process requires a Global Administrator or Application Administrator in the tenant.

  1. Open Enterprise Application settings.

  2. Select Grant admin consent for organization.

  3. If you're able to do so, review the API permissions required for this application, as the following image shows. Provide consent for the tenant.

    grant consent image.

  4. If the administrator receives an error while attempting to provide consent manually, try either Option 1 or Option 2 as possible workarounds.

Option 1: Approve enterprise application permissions by user request

Microsoft Entra Administrators need to allow for users to request admin consent to apps. Verify the setting is configured to Yes in Enterprise applications.

Enterprise applications user settings.

More information is available in Configure Admin consent workflow.

Once this setting is verified, users can go through the enterprise customer sign-in at Microsoft security intelligence, and submit a request for admin consent, including justification.

Contoso sign in flow.

Administrators can review and approve the application permissions Azure admin consent requests.

After providing consent, all users in the tenant will be able to use the application.

This process requires that Global Administrators go through the Enterprise customer sign-in flow at Microsoft security intelligence.

Consent sign in flow.

Then, admins review the permissions and make sure to select Consent on behalf of your organization, and then select Accept.

All users in the tenant can now use this application.

Option 3: Delete and readd app permissions

If neither of these options resolve the issue, try the following steps (as an admin):

  1. Remove previous configurations for the application. Go to Enterprise applications and select delete.

    Delete app permissions.

  2. Capture TenantID from Properties.

  3. Replace {tenant-id} with the specific tenant that needs to grant consent to this application in the URL below. Copy the following URL into browser: https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=f0cf43e5-8a9b-451c-b2d5-7285c785684d&state=12345&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fwdsi%2ffilesubmission&scope=openid+profile+email+offline_access

    The rest of the parameters are already completed.

    Permissions needed.

  4. Review the permissions required by the application, and then select Accept.

  5. Confirm the permissions are applied in the Azure portal.

    Review that permissions are applied.

  6. Sign in to Microsoft security intelligence as an enterprise user with a non-admin account to see if you have access.

If the warning isn't resolved after following these troubleshooting steps, call Microsoft support.

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.