Clarification on Building Custom Data Connector for Microsoft Defender XDR

Question

Clarification on Building Custom Data Connector for Microsoft Defender XDR

Anonymous

Hi team, We have a customer interested in building a data connector with Microsoft Defender XDR. Based on this post, it appears that custom data connectors might not be supported for Defender XDR. However, this https://learn.microsoft.com/en-us/defender-endpoint/technological-partners, suggests that technology partners may have the ability to build such connectors. We’d really appreciate your clarification on the following:

Is it possible to build a connector either as a Microsoft technology partner or through any other type of partnership? If so, can it be published to the marketplace or shared with customers for installation?
If yes, would the connector support configuration, data collection or polling via REST API, and dashboards? If not, could you share what kind of integration is supported?

Thanks in advance for your help!

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2025-11-25T09:43:59.9766667+00:00

Hello @Darshil Mehta ,
Yes – it’s possible to build a Defender XDR connector as an official Microsoft partner. Microsoft provides a program (e.g. the Open App Connector Platform) for technology partners (such as SaaS vendors) to create their own integrations.
Distribution is through Microsoft’s channels (partner catalog/marketplace) rather than ad-hoc sharing. Connectors built via the partner program are made available to customers as supported integrations in the Defender XDR ecosystem. In practice, this means the connector will appear in Microsoft’s security portal or catalogs for easy customer enablement (analogous to publishing on a marketplace). For example, some partner solutions are listed on Microsoft’s AppSource or in-product catalogs so customers can install/enable them directly. (In short, partners don’t privately send connectors to customers; they distribute them through Microsoft’s approved listing for Defender XDR integrations.)
https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/microsoft-empowers-partners-to-securely-build-their-own-connector-on-its-open-ap/3876496

Your answer

Pauline Mbabu 1,840 Reputation points Microsoft Employee

2025-11-25T09:43:59.9766667+00:00

Hello @Darshil Mehta ,
Yes – it’s possible to build a Defender XDR connector as an official Microsoft partner. Microsoft provides a program (e.g. the Open App Connector Platform) for technology partners (such as SaaS vendors) to create their own integrations.
Distribution is through Microsoft’s channels (partner catalog/marketplace) rather than ad-hoc sharing. Connectors built via the partner program are made available to customers as supported integrations in the Defender XDR ecosystem. In practice, this means the connector will appear in Microsoft’s security portal or catalogs for easy customer enablement (analogous to publishing on a marketplace). For example, some partner solutions are listed on Microsoft’s AppSource or in-product catalogs so customers can install/enable them directly. (In short, partners don’t privately send connectors to customers; they distribute them through Microsoft’s approved listing for Defender XDR integrations.)
https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/microsoft-empowers-partners-to-securely-build-their-own-connector-on-its-open-ap/3876496