The Problem

When configuring the native Microsoft Defender connector in ServiceNow SIR, the connection test fails with an authorization error — even when the required API permissions appear to be configured in Azure.

---

Root Cause

The permissions were granted as Delegated instead of Application type.

The ServiceNow connector uses the OAuth 2.0 Client Credentials.  Delegated permissions require a signed-in user and will not work for this integration.

---

The Fix

In the Azure App Registration, ensure all three permissions are set as Application — not Delegated — and that admin consent is granted :

Permission	Type
SecurityIncident.Read.All	✅ Application
SecurityIncident.ReadWrite.All	✅ Application

 

⚠️ After adding Application permissions, you must click "Grant admin consent" in the Azure portal. Without this step, the permissions won't be active.

Quick Checklist

• Permissions type = Application (not Delegated)
• Admin consent = Granted
• Credentials in ServiceNow = Client ID, Client Secret, Tenant ID

Once corrected, the connection test succeeds immediately.

Regards,

Sarah Bioni Nascimento