---
title: Microsoft Defender Actions
description: "## Actions for Microsoft Defender - ***Isolate Machine***. Disconnects one or more devices from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device. - ***Unisolate Machine***. Reconnects one or more devices to…"
url: "https://lucidum.io/docs/microsoft-defender-actions/"
updated: "2025-09-23"
category: Actions / List of Actions / M
---

# Microsoft Defender Actions

## Actions for Microsoft Defender

- ***Isolate Machine***. Disconnects one or more devices from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device.
- ***Unisolate Machine***. Reconnects one or more devices to the network.

Devices that are behind a full VPN tunnel won't be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. Microsoft recommends using a split-tunneling VPN for Microsoft Defender for Endpoint traffic.

## Use Cases

Below are the possible use cases for these actions:

- You can isolate endpoints that are actively involved in a security incident (such as malware infections or cyber-attacks) and unisolate the endpoints when the incident is remediated.

## Prerequisites

Before you can execute the actions for Microsoft Defender, you must first create an application to access Microsoft Defender.

- To do this, see [https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp?view=o365-worldwide](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp?view=o365-worldwide).
- The application requires **WindowsDefenderATP** **Write**permission.

## Workflows

- [Creating a new Configuration and a new Action](https://lucidum.io/docs/overview-of-actions#workflow_for_creating_configurations_and_actions_in_lucidum)
- [Cloning an Existing Action](https://lucidum.io/docs/overview-of-actions#workflow_using_clone_to_create_a_new_action)
- [Creating a new Action from the Location Results page](https://lucidum.io/docs/overview-of-actions#alternative_workflow_for_creating_an_action)
- [Editing a Configuration](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_a_configuration)
- [Editing an Action](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_an_action)
- [Viewing Information about an Action](https://lucidum.io/docs/overview-of-actions#viewing_information_about_an_existing_action_and_executing_an_action_on_demand)

## Microsoft Defender Configuration

![ms_defender_config.png](https://lucidum.cloud/docs/ms_defender_config.png)

- ***Configuration Name.*** Identifier for the Configuration. This name will appear in the Lucidum Action Center.
- ***URL***. The base URL for Microsoft Defender API
- ***Client ID***. The client ID of the application.
- ***Client Secret***. The client secret associated with the client ID.
- ***Tenant ID***. Before configuring the Microsoft Defender Advanced Threat Protection connector in Lucidum, you must first create an application that has read **and write** access to Microsoft Defender Advanced Threat Protection. For details, see the documentation for Microsoft Defender. The application requires **WindowsDefenderATP** **Write**permission. In this field, specify the tenant ID of the application.

## Create or Edit an Action

To create an action for Microsoft Defender:

1. In the **Create a New Action** page, in the **General**step, enter:

   ![ms_defender_general_page.png](https://lucidum.cloud/docs/ms_defender_general_page.png)

   - ***Description***. After saving an Action, Lucidum uses the Luci LLM to populate this field automatically. You cannot edit the value in this field.
   - ***Business Value***. After saving an Action, Lucidum uses the Luci LLM to populate this field automatically. You cannot edit the value in this field.
   - ***Action Type***. Select from the list of possible action types.
   - ***Configuration Name***. Select an action configuration from the pulldown options.
   - ***Action Name***. Identifier for the action. This name will appear in the Lucidum Action Center.
   - ***Author Comments***. Custom comments about the Action.
2. Click the **Next**(>) icon.
3. In the **Filters** page, click **Configure Filters**.

   ![filters_page.png](https://lucidum.cloud/docs/filters_page.png)
4. The **Build a Query**page appears.

   ![build_query1_updated.png](https://lucidum.cloud/docs/build_query1_updated.png)
5. In the **Build a Query**page, you define the query for the assets or users that the action will act upon.
6. Click **Next**.
7. In the **Build a Current Query**page, enter the fields, operators, and values for the query. For existing actions, the query is already loaded in this page.

   ![build_query2_updated.png](https://lucidum.cloud/docs/build_query2_updated.png)
8. For details on creating and editing queries in Lucidum, see the section on [Building Queries](https://lucidum.io/docs/building-queries).
   **NOTE**: To optimize performance, the default time range is *Current*. If you need to access historical data, contact Lucidum Custom Success for help on using historical data without affecting performance.
9. Click the **Apply** (page and pencil) icon.
10. Click the **Next**(>) icon.
11. In the **Schedule** step, enter:

    ![ms_defender_new_action3.png](https://lucidum.cloud/docs/ms_defender_new_action3.png)

    - ***Schedule Type***. Define the schedule for the action. Choices are:

      - ***Recurrence***. Specify a frequency for the recurring schedule.
      - ***After Data Ingestion***. The action is executed after data ingestion, which happens at least once every 24 hours and can also be triggered manually.
    - ***Do not trigger the action unless***. Specify the number of results from ***Filters*** as a prerequisite for executing the action.
12. Click the **Next**(>) icon.
13. In the **Details** step, enter the following:

    ![ms_defender_new_action4.png](https://lucidum.cloud/docs/ms_defender_new_action4.png)

    - ***Output Fields***. For the records selected with the ***Filters*** field, specify the columns to display. When creating or editing the query, you can select these fields in the **Query Results** page > **Edit Column**button.
    - ***Machine Action***. Specify the type of action to perform. Choices are:

      - ISOLATE_MACHINE. When an attack has been detected, you can ISOLATE_MACHINE to isolate the device from the network. All devices that match the query in the Filters page will be isolated.
      - UNISOLATE_MACHINE. When the attack has been remediated, you can UNISOLATE_MACHINE to allow the device on the network. All devices that match the query in the Filters page will be unisolated.