Cookie settings

Choose which cookies Keepnet can use. You can change this at any time from "Cookie settings" at the bottom of every page.

Book a demo
All integrations

Behaviour signals, Reporting

Keepnet + Microsoft Defender integration

Turn Defender alerts into each employee’s behaviour record.

Signals in

Keepnet integrates with Microsoft Defender to turn Defender alerts into each employee’s behaviour record.

What you get

  • Defender alerts linked to the employee involved
  • One incident counts once, even when it raises several alerts
  • Reported emails can also go to your Defender reporting address

How it works

  1. Keepnet reads alerts from Microsoft Graph security alerts
  2. The alert’s subject is taken from its evidence and matched to an employee
  3. The behaviour is recorded with a severity and shapes what comes next

Data and permissions

DataDirectionDetail
Security alerts (alerts_v2)InRead only (SecurityAlert.Read.All)
Reported emailsOutForwarded to your Defender report address, if you turn it on

What you need

  • Microsoft Defender
  • Admin consent for the Keepnet app in Entra ID

Set up

Connect your tenant in Company settings, then choose which Defender products to read from.

Related integrations

Entra ID ProtectionMicrosoft SentinelGoogle SecOps
Works with
Secure Behaviour Dashboard, Agentic AI, Phishing Reporter
Built by
Keepnet
Last updated
October 2026
Book a demo

See Keepnet with your stack in mind

  1. See your tools connectedMicrosoft 365 or Google Workspace, your identity provider and your SIEM.
  2. Watch signals become behavioursHow Defender, Sentinel or Mimecast events shape what each employee gets next.
  3. Review data and permissionsWhat each integration reads, and where your data is stored.
Tom, Matt, Ellie and Shonna, the Keepnet team you will meet
Who you will actually meet
Tom, Matt, Ellie and Shonna
Across UK and US time zones

Book a 30-minute demo

Thirty minutes, no cost and no obligation.

Required
Required
Please use your work email address
Where your organisation is based.
Please pick a country from the list
Start with + for another country code.
Please enter a phone number we can call you on
Required
Employees
Please pick a size
Please pick one

Bring your setup and questions, and we will map Keepnet to your programme. No employee data needed.

Thank you, your request is in

A confirmation is on its way to your inbox.

While you wait