Is there an API for Microsoft Defender multitenant management?

Reviewed by ContraForce team · Updated 2026-09-04

> Microsoft publishes no API for multitenant management operations. The Defender XDR supported-APIs page lists exactly three: Advanced Hunting, Incident, and Streaming. No Graph resource, REST endpoint, or PowerShell cmdlet is documented for creating, editing, or syncing content distribution profiles, and every documented path for those runs through the portal.

What does Microsoft actually expose?

The Microsoft Defender XDR supported-APIs reference enumerates three API surfaces: Advanced Hunting, Incident, and Streaming. Each is scoped to a tenant. None of them addresses multitenant management.

The Microsoft Graph security API overview enumerates eleven feature areas, covering advanced hunting, alerts, attack simulation and training, eDiscovery and others. Multitenant management is not among them. Graph exposes `runHuntingQuery` for running a KQL query against data stored in Microsoft 365 Defender, which is per tenant.

So the per-tenant API surface is real and reasonably complete. What has no programmatic surface is the layer above it.

What specifically cannot be automated?

Content distribution is the clearest case. Microsoft's own documentation for creating a distribution profile ends at a portal action, and no API reference, Graph resource, or cmdlet exists for creating, editing, or triggering a sync of one. Microsoft's MSSP guidance routes this work to the portal's built-in multitenant management.

What does portal-only management cost at scale?

Every multi-tenant operation becomes a human sitting in a console. Onboarding a detection rule to eighty customers is eighty portal interactions, or one distribution profile that itself was created by hand and whose sync is triggered by hand.

Three consequences follow, and they compound rather than add:

• No version control. Detection content that exists only as portal state has no diff, no history, and no review before it reaches production.
• No CI/CD. Content cannot be promoted through environments, because there is no non-interactive way to apply it.
• No verification. Confirming that all eighty tenants received the same rule means checking all eighty, in the portal, by hand.

What changes with an API-first control plane?

The gap above is not a Microsoft failure so much as a layer that does not exist yet in the platform. Something has to hold the multi-tenant abstraction and expose it programmatically.

ContraForce is API-first for this reason: workspaces, incidents, verdicts, and response actions are addressable through its own API and webhook surface, so multi-tenant operations can be scripted, reviewed, and run from a pipeline rather than performed in a console. Detection content is managed as versioned repositories with per-workspace deployment and rollback, which is the version control the portal path lacks.

Sources

• Microsoft Defender XDR supported APIs
• Microsoft Graph security API overview
• Manage multitenant content distribution
• Microsoft Defender multitenant management requirements