# Error 403 Forbidden when connect to Microsoft Defender API

**URL:** https://discuss.elastic.co/t/error-403-forbidden-when-connect-to-microsoft-defender-api/273232
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [May 18, 2021, 6:00am UTC](https://discuss.elastic.co/t/error-403-forbidden-when-connect-to-microsoft-defender-api/273232 "2021-05-18T06:00:29Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ismyhairnice](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismyhairnice/32/68353_2.png) [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)
#### Post date: [May 18, 2021, 6:00am UTC](https://discuss.elastic.co/t/error-403-forbidden-when-connect-to-microsoft-defender-api/273232/1 "2021-05-18T06:00:29Z")

</div>

Hi all

I am trying to connect to Microsoft Defender API using Elastic Filebeat. I followed the instructions here [https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp?view=o365-worldwide](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-create-app-webapp?view=o365-worldwide) register a new application with granted permission.

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7ea5b12fc6218e01086e0684e5c1394c79304521.png)

However, when trying to call the api, i encountered this message:

```auto
Error while processing http request: failed to execute http [client.Do](http://client.do/): server responded with status code 403:
{"error":{"code":"Forbidden","message":"The application does not have any of the required application permissions
(Alert.ReadWrite.All, Alert.Read.All, Incident.ReadWrite.All, Incident.Read.All) to access the resource.","target":<target id>}}
{"input_source": "https://api.security.microsoft.com/api/incidents", "input_url": "https://api.security.microsoft.com/api/incidents"}

```

Can anyone assist me on this ?

Filebeat version: 7.12

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 15, 2021, 8:01am UTC](https://discuss.elastic.co/t/error-403-forbidden-when-connect-to-microsoft-defender-api/273232/2 "2021-06-15T08:01:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.