Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
13,563 questions
MS Defender - How to manage Tenant Allow/Block Lists with graph api
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 63%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EOD%3C/text%3E%3C/svg%3E)
Omer Dital
15
Reputation points
Hi, I'm trying to create an integration to block certain URLs on Microsoft Defender with the Graph API.
After looking into the documentation, I found this endpoint: https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http, is it the correct one to use?
I also saw that tiindicators are deprecated, what is the new approach then?
thank you!
Microsoft Graph
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,532 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
255 questions
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 90%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
Pauline Mbabu 830 Reputation points Microsoft Employee2024-07-18T09:42:55.4+00:00 Hello Omer,
Based on our research the feasible way to manage Tenant Allow/Block List is by using PowerShell Scripts. This is documented here https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about.
The tiIndicator entity is deprecated and will be removed by April 2026. -
Omer Dital 15 Reputation points
2024-09-15T08:05:36.27+00:00 Hi @Pauline Mbabu @Pauline Mbabu , thank you for the response.
Is there another way (not specifically TreatIndicators) to pass applications\urls to Block on Microsoft Defender via API?
I want to be able to send a list of urls\domains from a web application via API to be blocked on Microsoft Defender.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 20%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENM%3C/text%3E%3C/svg%3E)
Nicolas Mourad 0 Reputation points2024-10-14T18:32:58.2133333+00:00 Hello @Pauline Mbabu any feedback on this?
It is a very simple yet key element to scale security response automation and processes and the current solution to rely on powershell script is very not convenient and not aligned with the global move to Graph API. -
Pauline Mbabu 830 Reputation points Microsoft Employee
2024-10-22T19:42:26.01+00:00 Hello @Nicolas Mourad ,
Apologies for the late response. I am checking on this Internally I will get back to you. -
Omer Dital 15 Reputation points
2024-10-23T06:51:08.5566667+00:00 @Pauline Mbabu @Pauline Mbabu Can you please reply with the answer in this conversation?
-
Pauline Mbabu 830 Reputation points Microsoft Employee
2024-10-23T08:17:27.22+00:00 @Omer Dital Sure, I will reply back on this conversation as soon as I get direction on this.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 70%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELK%3C/text%3E%3C/svg%3E)
Lucas Krupinski 10 Reputation points2025-04-02T03:10:29.5033333+00:00 Did we ever get an answer to this?
Sign in to comment
Sign in to answer