Create custom reports using Power BI

Applies to: Microsoft Defender for Endpoint

Note

If you're a US Government customer, use the URIs listed in Microsoft Defender for Endpoint for US Government customers.

Tip

For better performance, instead of using api.security.microsoft.com, use a server closer to your geolocation:

us.api.security.microsoft.com
eu.api.security.microsoft.com
uk.api.security.microsoft.com
au.api.security.microsoft.com
swa.api.security.microsoft.com
ina.api.security.microsoft.com
aea.api.security.microsoft.com

Create Power BI reports on top of Defender for Endpoint APIs.

The first example demonstrates how to connect Power BI to Advanced Hunting API, and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts.

Connect Power BI to Advanced Hunting API

Perform the following steps to connect Power BI to the Advanced Hunting API and build a report from query results.

Open Microsoft Power BI.
Select Get Data > Blank Query.
Select Advanced Editor.

Copy the code snippet below and paste it in the editor. This query uses the Advanced Hunting API to retrieve up to 20 DeviceEvents entries where the action type contains "Anti", and maps the response schema to Power BI data types:

    let
        AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti' | limit 20",

        HuntingUrl = "https://api.security.microsoft.com/api/advancedqueries",

        Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])),

        TypeMap = #table(
            { "Type", "PowerBiType" },
            {
                { "Double",   Double.Type },
                { "Int64",    Int64.Type },
                { "Int32",    Int32.Type },
                { "Int16",    Int16.Type },
                { "UInt64",   Number.Type },
                { "UInt32",   Number.Type },
                { "UInt16",   Number.Type },
                { "Byte",     Byte.Type },
                { "Single",   Single.Type },
                { "Decimal",  Decimal.Type },
                { "TimeSpan", Duration.Type },
                { "DateTime", DateTimeZone.Type },
                { "String",   Text.Type },
                { "Boolean",  Logical.Type },
                { "SByte",    Logical.Type },
                { "Guid",     Text.Type }
            }),

        Schema = Table.FromRecords(Response[Schema]),
        TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}),
        Results = Response[Results],
        Rows = Table.FromRecords(Results, Schema[Name]),
        Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}}))

    in Table

Select Done.
Select Edit Credentials.
Select Organizational account > Sign in.
Enter your credentials and wait to be signed in.
Select Connect.

Now the results of your query appear as a table and you can start to build visualizations on top of it! You can duplicate this table, rename it, and edit the Advanced Hunting query inside to get any data you would like.

Connect Power BI to OData APIs

The only difference between the Advanced Hunting API example and the OData API example is the query inside the editor.

Open Microsoft Power BI.
Select Get Data > Blank Query.
Select Advanced Editor.
Copy the following code, and paste it in the editor. This query uses the OData API to retrieve all Machine Actions from your organization, which you can use to build reports on response activities such as device isolation or antivirus scans:
```
    let

        Query = "MachineActions",

        Source = OData.Feed("https://api.security.microsoft.com/api/" & Query, null, [Implementation="2.0", MoreColumns=true])
    in
        Source
```
You can do the same for Alerts and Machines. You also can use OData queries for queries filters. See Using OData Queries.

Power BI dashboard samples in GitHub

See the Power BI report templates.

Feedback

Was this page helpful?

Last updated on 2026-07-28