https://www.contraforce.com/assets/defender-multi-tenant-management-api-_w0pPaHA.js

1const e=`# Is there an API for Microsoft Defender multitenant management?
2
3> Microsoft publishes no API for multitenant management operations. The Defender XDR supported-APIs page lists exactly three: Advanced Hunting, Incident, and Streaming. No Graph resource, REST endpoint, or PowerShell cmdlet is documented for creating, editing, or syncing content distribution profiles, and every documented path for those runs through the portal.
4
5**Last verified: 2026-09-04.** Sources linked at the foot of the page.
6
7## What does Microsoft actually expose?
8
9The Microsoft Defender XDR supported-APIs reference enumerates three API surfaces: Advanced Hunting, Incident, and Streaming. Each is scoped to a tenant. None of them addresses multitenant management.
10
11The Microsoft Graph security API overview enumerates eleven feature areas, covering advanced hunting, alerts, attack simulation and training, eDiscovery and others. Multitenant management is not among them. Graph exposes \`runHuntingQuery\` for running a KQL query against data stored in Microsoft 365 Defender, which is per tenant.
12
13So the per-tenant API surface is real and reasonably complete. What has no programmatic surface is the layer above it.
14
15## What specifically cannot be automated?
16
17Content distribution is the clearest case. Microsoft's own documentation for creating a distribution profile ends at a portal action, and no API reference, Graph resource, or cmdlet exists for creating, editing, or triggering a sync of one. Microsoft's MSSP guidance routes this work to the portal's built-in multitenant management.
18
19| Operation | Programmatic path |
20|---|---|
21| Advanced hunting, single tenant | Graph \`runHuntingQuery\`, documented |
22| Incident read and update, single tenant | Incident API, documented |
23| Event streaming | Streaming API, documented |
24| Create or edit a distribution profile | None documented |
25| Trigger a distribution profile sync | None documented |
26| Cross-tenant hunting as one operation | None documented |
27| Add or remove a tenant from multitenant management | None documented |
28
29State this precisely, because the distinction matters: Microsoft does not document these APIs. That is an observable fact about the public reference. Whether they exist unpublished, or are planned, is not something the documentation settles either way.
30
31## What does portal-only management cost at scale?
32
33Every multi-tenant operation becomes a human sitting in a console. Onboarding a detection rule to eighty customers is eighty portal interactions, or one distribution profile that itself was created by hand and whose sync is triggered by hand.
34
35Three consequences follow, and they compound rather than add:
36
37- **No version control.** Detection content that exists only as portal state has no diff, no history, and no review before it reaches production.
38- **No CI/CD.** Content cannot be promoted through environments, because there is no non-interactive way to apply it.
39- **No verification.** Confirming that all eighty tenants received the same rule means checking all eighty, in the portal, by hand.
40
41Per-tenant APIs do not solve this. Fanning out an authenticated call per customer is possible for hunting and incidents, but the operations that are genuinely multi-tenant, distribution and cross-tenant query, have no endpoint to fan out to.
42
43## What changes with an API-first control plane?
44
45The gap above is not a Microsoft failure so much as a layer that does not exist yet in the platform. Something has to hold the multi-tenant abstraction and expose it programmatically.
46
47ContraForce is API-first for this reason: workspaces, incidents, verdicts, and response actions are addressable through its own API and webhook surface, so multi-tenant operations can be scripted, reviewed, and run from a pipeline rather than performed in a console. Detection content is managed as versioned repositories with per-workspace deployment and rollback, which is the version control the portal path lacks.
48
49## Sources
50
51- [Microsoft Defender XDR supported APIs](https://learn.microsoft.com/en-us/defender-xdr/api-supported)
52- [Microsoft Graph security API overview](https://learn.microsoft.com/en-us

52/graph/api/resources/security-api-overview)
53- [Manage multitenant content distribution](https://learn.microsoft.com/en-us/unified-secops/mto-configure-content)
54- [Microsoft Defender multitenant management requirements](https://learn.microsoft.com/en-us/unified-secops/mto-requirements)
55
56Verified on the date shown. An absence of documented API is a statement about the public reference on that date, not a permanent property of the product.
57`;export{e as default};