Microsoft integration
Microsoft Graph and Defender for Endpoint integration
LICENSEWARE reads Microsoft Graph for users, assigned licenses, Microsoft 365 usage and the devices in Entra ID and Intune, and Defender for Endpoint for machines and the software installed on them. Both sync on a schedule, with no export to run.
Microsoft
Why teams run Microsoft Graph and Defender
In a Microsoft estate, Graph is where the tenant's users, licenses and managed devices are, and Defender for Endpoint is on the machines themselves.
One endpoint for the tenant
Microsoft calls Graph the gateway to data in Microsoft cloud services like Entra and Microsoft 365. One endpoint, graph.microsoft.com, covers Microsoft 365, Entra ID and Intune. Source
Security on every endpoint
Defender for Endpoint is Microsoft's enterprise endpoint security platform, on Windows, macOS, Linux, Android and iOS. Microsoft 365 E5 includes Defender for Endpoint Plan 2. Source
A software inventory from the same signals
Defender lists the software installed in your network with its vendor, versions and the devices it is on, discovered from the signals it uses for detection, and tags software that has reached end of support. Source
Sources: Microsoft Learn, as of 3 November 2026.
Integration
Why we built a Microsoft Graph and Defender API integration
Graph knows who holds which Microsoft 365 license. Defender knows what runs on each machine. A license position needs both, and the contracts behind them.
The tenant itself
Graph already holds every user, their assigned licenses and their Microsoft 365 activity, so we read the tenant directly instead of working from an export that is out of date the day after it is taken.
No second agent
Defender for Endpoint is deployed for coverage, so its device list is one of the most complete an organization has. We read it through the API instead of asking you to deploy another agent on the same machines.
From installs to entitlements
Neither tool says what you are entitled to. LICENSEWARE sets the licenses and installs against your agreements per vendor, keeps the renewal dates in LCM and shows the unused licenses before the next renewal.
What our connectors read
- Microsoft Graph API: user profiles, assigned licenses, service plan assignments and disabled accounts from Entra ID; Microsoft 365 usage and activity reports; Entra ID joined, hybrid and Intune-managed devices with their OS, ownership and compliance state; and the Intune app inventory. Read-only permissions. Read by SIM, IFMP, MDM and LCM.
- Microsoft Defender for Endpoint API: machines and their software inventory, synced on a schedule. Read by SIM, IFMP, ADM, MDM, OJDM and RDM.
In LICENSEWARE
What you see in LICENSEWARE
Seven apps read one or both connections. Microsoft Deployment Manager reads both.
Microsoft Deployment Manager
Microsoft 365 licenses and usage from Graph, and the Microsoft software Defender finds on each machine, in one Microsoft picture.
Software Inventory Manager
Defender's software inventory and the Intune app inventory, recognized beside the software from your other sources.
Infrastructure Mapper
The devices from Entra ID, Intune and Defender, placed in the infrastructure around them.
License and Contracts Manager
Your Microsoft agreements, entitlements and renewal dates, next to the licenses Graph reports.
Adobe Deployment Manager
Adobe installs from Defender's inventory.
Oracle Java Deployment Manager
Java installations on every machine Defender covers.
Red Hat Deployment Manager
Red Hat installs on the Linux machines Defender protects.
Every connection is on data sources, and the data sources demo walks through the view in the app. Microsoft 365 Copilot has its own connection: see Copilot license cost. The Graph launch is described in our announcement, and LICENSEWARE for Microsoft covers the Microsoft Marketplace listing and every other Microsoft data source.
Setup
How to connect Microsoft Graph and Defender
LICENSEWARE runs as SaaS, so both integrations are already in your instance. There is nothing to install locally.
Open Datasources
In LICENSEWARE, open Datasources and search for Microsoft. Click Microsoft Graph, then Connect, and Continue to be sent to Microsoft to sign in.
Grant tenant consent
Sign in as an administrator or with a suitable delegated role, review the read-only permissions and grant consent for the tenant. Add Defender for Endpoint from Datasources the same way.
Run the first sync
Click Sync Now or wait for the schedule: API connections sync twice a week, Monday and Wednesday at 22:00 UTC. The source's page shows the last sync and the devices and installs it brought in.
Step by step, with every permission: Microsoft Graph API integration guide.
FAQ
Frequently asked questions
IntuneDoes LICENSEWARE connect to Microsoft Intune?
Yes, through Microsoft Graph. The Graph connection brings in Intune-managed devices and the Intune app inventory, with Entra ID devices and Microsoft 365 licenses. A one-off Intune export into Software Inventory Manager also works, as the Intune export guide shows.
PermissionsWhat permissions does the Microsoft Graph connection ask for?
Read-only ones: read all users' full profiles, read all usage reports, read all devices, read Microsoft Intune managed devices and read directory data. LICENSEWARE has no write access and makes no changes to your tenant.
DifferenceWhat does Defender for Endpoint add to Microsoft Graph?
The software on each machine. Graph tells LICENSEWARE who holds which Microsoft 365 license and which devices exist; Defender for Endpoint lists the machines it protects and the software installed on them, which the Adobe, Microsoft, Oracle Java and Red Hat deployment managers read.
SyncHow often does the data refresh?
API connections sync twice a week, on Monday and Wednesday at 22:00 UTC. Sync Now starts one straight away, and each run is listed on the source's page with its status.
CopilotDoes this cover Microsoft 365 Copilot usage?
Copilot has its own connection, which brings usage per user into Software Inventory Manager for AI cost management. Our Copilot license cost page covers what the seats cost.
SecurityWhere is the Microsoft data stored?
In your LICENSEWARE tenant. LICENSEWARE runs as SaaS only, with instances in the EU, the US (Iowa) and Australia, and is SOC 2 Type 2 attested.
Other integrations: Jamf Pro, Freshservice and Lansweeper.
Start your Microsoft position from the tenant
Connect Microsoft Graph and Defender for Endpoint and LICENSEWARE reads licenses, usage and installs on a schedule. Book 30 minutes and we walk through it with you.