## Introduction

Microsoft Defender External Attack Surface Management (EASM) discovers and monitors the internet-facing resources your organization owns. This guide shows you how to prepare an application registration in Microsoft Entra ID and gather the values you need to configure the integration.

## Prerequisites

Before you begin, ensure that you have:

- An Azure subscription with a Defender EASM workspace
- Permission to register an application in Microsoft Entra ID and to assign roles on the workspace


## Required Permissions

| Role | Scope | Purpose |
|  --- | --- | --- |
| Reader | The Defender EASM workspace | Read the assets and observations the workspace has discovered |


## Registering an Application

1. In the Azure portal, register a new application in Microsoft Entra ID
2. Create a client secret for the application. Take note of the *Client ID* and the secret value, and store them in a safe location
3. Open your Defender EASM workspace, then select **Access control (IAM)**
4. Assign the **Reader** role to the application you registered
5. You have now registered an application. Proceed to the next section titled [Finding Your Workspace Details](#finding-your-workspace-details)


For more information on registering an application, see the [Microsoft register an application docs page](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)

## Finding Your Workspace Details

1. In the Azure portal, open your Defender EASM workspace
2. Select **Overview**
3. Take note of the subscription, resource group, workspace name, and region


The workspace address holds the same four values if you prefer to read them there. It uses this format:

`https://{region}.easm.defender.microsoft.com/subscriptions/{subscription}/resourceGroups/{resource group}/workspaces/{workspace name}`

## Configuring the Integration

To configure a new Microsoft Defender EASM integration, provide each of the values as defined below:

| Integration Parameter | Description |
|  --- | --- |
| Client ID | The Client ID of the application you registered |
| Client Secret | The client secret value you took note of when you registered the application |
| Tenant ID | The Microsoft Entra ID tenant that holds the application you registered |
| Subscription ID | The subscription you took note of in the previous section |
| Resource Group | The resource group you took note of in the previous section |
| Workspace Name | The workspace name you took note of in the previous section |
| Region | The region you took note of in the previous section  Example `eastus` |


## Additional Resources

- [What is Microsoft Defender EASM?](https://learn.microsoft.com/en-us/azure/external-attack-surface-management/overview)