---
sourceDocument: Yokohama ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/servicenow-platform
Release :
- yokohama
ft:locale :
- en-US
ft:publication_title :
- Yokohama ServiceNow AI Platform Capabilities
ft:clusterId :
- platcap
bundleId :
- platcap
workflow :
- Platform
---
# Configure using SGC Central
# Configure Service Graph Connector for Microsoft Defender Endpoint using SGC Central {#ariaid-title1}
* Release version: Yokohama
*
* Updated March 6, 2026
*
*  3 minutes to read
Set up scheduled import jobs to pull in Microsoft Defender for Endpoint data into your Configuration Management Database (CMDB).
## Before you begin
Complete the following tasks:
* Install Service Graph Connector for Microsoft Defender Endpoint version 1.1.0 or later from the ServiceNow Store. For ServiceNow Store installation steps, see [Install a ServiceNow Store
application](https://www.servicenow.com/docs/access?context=t_InstallApplications&version=yokohama&pubname=yokohama-platform-administration&ft:locale=en-US).
* Verify that you have an active subscription to Microsoft Defender for Endpoint.
* Verify that you have created an Azure application to get programmatic access to Microsoft Defender for Endpoint. See [Create an app to access Microsoft Defender for Endpoint without a user](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp?view=o365-worldwide) in the Microsoft 365 documentation.
* Obtain the tenant ID, client ID, and client secret details for the Microsoft Defender for Endpoint administrator account.
* Enable the Machine.Read.All and Machine.ReadWrite.All permissions in Microsoft Defender for Endpoint. See [Permissions](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/get-machines?view=o365-worldwide#permissions) for the List machines API in the Microsoft 365 documentation.
{#sgcc-configure-msdefender__ul_pds_prx_tzb}
Role required: The following table shows the roles required for each stage of the playbook.{#sgcc-configure-msdefender__table_zcy_w5p_4hc__entry__2}
| Stage | Role |
|-|-|
| Prerequisites | admin |
| Setup | SGC-Admin (sn_cmdb_int_util.sgc_admin) or admin |
[Table 1. Role required for each playbook stage]
{#sgcc-configure-msdefender__table_zcy_w5p_4hc}
Note:
The admin user role is required to run background scripts and to provide access to global tables to the SGC-Admin user. For information about the user roles for Service Graph Connectors, see [Service Graph Connector user roles](https://www.servicenow.com/docs/_TGfY39bTmS1jnrCEL6y0Q#cmdb-sgc-intro__section_ett_spp_4hc).
## About this task
The playbook experience for onboarding connectors is activated with SGC Central in the Service Graph Workspace or CMDB Workspace. To configure the SGC Central application, see [Configuring SGC Central](https://www.servicenow.com/docs/v3JtnHOfaTjWL4eWMTSQyA "Set up the SGC Central application for onboarding and maintaining Service Graph Connectors and monitoring the errors related to connections added using Service Graph Connectors.") and for more information on how to interact with a playbook, see [Interact with Playbook](https://www.servicenow.com/docs/access?context=playbook-ui&version=yokohama&pubname=yokohama-build-workflows&ft:locale=en-US).
## Procedure
1. Use one of the following methods to open SGC Central:
* Navigate to WorkspacesService Graph Workspace, and from the left navigation panel, select the Ingestion icon ![]() to open the SGC Central view.
* Navigate to WorkspacesCMDB WorkspaceSGC Central.
{#sgcc-configure-msdefender__choices_bd1_nrz_k3c}
2. On the Overview page, select Create connection.
Tip:
Alternatively, you can select Create connection on the All connections page.
3. On the Create connection window, select the Microsoft Defender connector type, and then select Configure connection.
A default connection, SG Defender OAuth2.0 connection, for Microsoft Defender for Endpoint is available within the application. As the Service Graph Connector for Microsoft Defender Endpoint supports only a single instance, you can configure the default connection for the first time or resume editing it thereafter.
4. Complete the initial prerequisites when setting up a connection for the first time using a connector.
Note:
This step is required only during the first-time setup. See [Perform initial setup tasks when creating a connection in SGC Central](https://www.servicenow.com/docs/w5ZZk3LTh8No7aHAE6tFeQ "Complete the prerequisites for setting up a connection for the first time using a Service Graph Connector within the SGC Central view of the Service Graph Workspace or CMDB Workspace.").
5. Enter connection details and test the API connection for importing Microsoft Defender for Endpoint data.
1. In the Setup stage of the playbook, select the Configure and test connection activity.
2. On the form, fill in the fields.
{#sgcc-configure-msdefender__table_ahn_xtg_rmb__entry__2}
| Field | Description |
|:-|:-|
| Connection Name | Name to identify the Microsoft Defender for Endpoint connection record. Note: This field is automatically set to SG Defender OAuth2.0 connection. Leave the field value as is. |
| OAuth Client ID | Application (client) ID of your Microsoft Defender for Endpoint as described in the [Before you begin](https://www.servicenow.com/docs/TAHArJDEH0RdjEJpjpxgpQ#sgcc-configure-msdefender__prereq_bbj_rbg_ndc) section. |
| OAuth Client Secret | Client Secret of your Microsoft Defender for Endpoint as described in the [Before you begin](https://www.servicenow.com/docs/TAHArJDEH0RdjEJpjpxgpQ#sgcc-configure-msdefender__prereq_bbj_rbg_ndc) section. |
| OAuth token URL | Token URL of your Microsoft Defender for Endpoint. Enter the token URL in the following format: https://login.microsoftonline.com/<tenantid>/oauth2/v2.0/token Where <tenantid> is the tenant ID of your Microsoft Defender for Endpoint as described in the [Before you begin](https://www.servicenow.com/docs/TAHArJDEH0RdjEJpjpxgpQ#sgcc-configure-msdefender__prereq_bbj_rbg_ndc) section. |
| Use MID Server | Option to use a MID Server. Note: Use of a MID Server is optional. |
| Mid Selection | Name of the MID Server used by the connector. This field appears only when the Use MID Server check box is selected. |
[Table 2. Configure and test connection form]
{#sgcc-configure-msdefender__table_ahn_xtg_rmb}
3. Select Update and test connection.
4. Once the connection test is complete, select Continue.
{#sgcc-configure-msdefender__substeps_p1l_fnb_gcc}
6. Configure the import schedule to import data at regular intervals.
1. In the Setup stage of the playbook, select the Configure import schedule activity.
2. Select Configure import schedule.
3. Expand the Parent scheduled data import within the Import schedules list to select the SG-Defender Machines import schedule.
4. In the Configure import schedule dialog box, select the Active check box, and then fill in the run schedule and time details.
For more information, see [Schedule a data import](https://www.servicenow.com/docs/access?context=t_ScheduleADataImport&version=yokohama&pubname=yokohama-integrate-applications&ft:locale=en-US#table_r53_5hm_xp).
5. Select Save.
Alternatively, select Execute Now to execute the import schedule immediately.
6. Select Continue.
{#sgcc-configure-msdefender__substeps_lf4_yvw_fcc}
7. In the Setup stage of the playbook, select the Confirm connection setup activity to verify whether the connection was configured.
## What to do next
Select View all connections to review the connection details. The configured connection appears in the Installed connections list.
**Related concepts**
* [Service Graph Connector for Microsoft Defender Endpoint](https://www.servicenow.com/docs/bfRKi7_7RmaUt3DtIZuVag "Use the Service Graph Connector for Microsoft Defender Endpoint to pull data from machines protected by the Microsoft Defender for Endpoint security solution into your ServiceNow instance.")
* [Accessing the connection details of Service Graph Connector for Microsoft Defender Endpoint](https://www.servicenow.com/docs/mduzgxfH5e_HX8ro52Q6eA#sgc-cmdb-msdefender-conn "You can access the connection details of the Service Graph Connector for Microsoft Defender Endpoint in a single view using the common connection framework (CCF) included within the Integration Commons for CMDB (sn_cmdb_int_util) store app.")
**Related reference**
* [CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint](https://www.servicenow.com/docs/Yov8SkvulYDi~3D2uCLJyg "When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item [cmdb_ci] table.")
*[\>]: and then