How to Automate Alert Escalation from Defender to PSA Systems

Microsoft Defender for Endpoint has powerful, real-time security alerting. However, IT technicians can overlook these alerts if they aren’t escalated the MSP’s PSA system. Automating alert escalation and ticket creation bridges the gap between detection and response. Integrating Defender with PSA software also ensures technicians can act on threats immediately.

For a video breakdown of this topic, watch How to Automate Alert Escalation from Defender to PSA Systems.

Using Microsoft Power Automate for alert escalation

Microsoft Defender for Endpoint offers a built-in Power Automate connector that automatically converts Defender alerts into actionable service tickets without requiring custom scripts. You will need admin access to Microsoft Power Automate to automate alert escalation from Defender to PSA systems.

1. Sign in to Microsoft Power Automate.
2. Go to My flows > New > Automated-from blank.
3. Search for “Microsoft Defender ATP Triggers” as the connector, then select the New Alerts trigger.
4. Choose your next action, such as isolating the device, sending an email, or triggering a webhook to create a PSA ticket.
5. Save and turn on the flow.

Learn more about how to use Power Automate to simplify MSP workflows.

Ways to automate alert escalation from Defender to PSA systems

You can automate alert escalation from Defender to PSA systems by retrieving Defender alerts, formatting the alert payload, triggering a webhook, scheduling alert polling, adding an audit trail, or using Group Policy to improve logging and alert context.

Prerequisites:

• Microsoft Defender for Endpoint Plan 2 or Microsoft 365 E5
• API access to your PSA system
• Microsoft Graph permissions: SecurityAlert.Read.All, if retrieving incidents, SecurityIncident.Read.All
• Microsoft Entra ID app registration for automation authentication
• Admin access to NinjaOne, RMM, or scripting engine
• PowerShell 7+ and Graph SDK module

Method 1: Connect to Microsoft Graph and retrieve Defender alerts

This method is excellent for IT teams looking to retrieve live Defender alerts

Part 1: Register your app in Entra ID (Azure AD)

1. Sign in to the Microsoft Entra admin center.
2. Browse to Entra ID > App registrations, then click New registration.
3. Enter a name for your app.
4. Specify who can use the application under the Supported account types.
5. Press Register to complete the registration.
6. Record the Application (client) ID shown in the application’s Overview page.

Part 2: Assign Microsoft Graph API permissions

1. Go to App registration then select the application you created, then navigate to API permissions.
2. Click Add a permission > Microsoft Graph
3. Choose:
   • Delegated permissions: If a signed-in user is involved
   • Application permissions: If your app runs in the background

Part 3: Generate and store a client secret

1. Select App registration, then select the application you created, then go to Certificates & secrets.
2. Click New client secret.
3. Add a description and expiration, then press Add.
4. Copy the secret Value immediately and store it securely, as it is only displayed once.

Part 4: Note the client ID, tenant ID, and client secret

Part 5: Connecting to Microsoft Graph and retrieving Defender alerts

1. Press Win, type PowerShell, then click Run as administrator.
2. Copy and paste the following script into the prompt, then press Enter:

• PowerShell connection script:

• Retrieve alerts:

Warning: Before deploying the settings change on different endpoints, it’s best to test it out on a local machine first.

Method 2: Format alert payload for PSA ticket creation

This method is for IT admins who want to prepare Defender alert details for submission to a helpdesk or PSA system.

To prepare ticket content from Microsoft Defender alerts and format it into a JSON payload for submission to a PSA system via webhook.

Step 1: Format the ticket title

• Construct a title using severity and title:
  • “[$($_.Severity)] $($_.Title)”
• Example:
  • [High] Ransomware activity detected

Step 2: Compose the ticket body

• Ensure you include relevant details when creating the ticket body:
  • Defender Alert: $alert.Description
  • Device: $alert.DeviceName
  • User: $alert.UserPrincipalName
  • Detected At: $alert.CreatedDateTime
  • Alert ID: $alert.Id
• Example:
  • Defender Alert: File encryption behavior detected on device LAPTOP-1234.
  • Device: LAPTOP-1234
  • User: [email protected]
  • Detected At: 2025-07-01T14:00:00Z
  • Alert ID: 3d7f2ae1-xxxx-yyyy-zzzz-abc123

Note: Field names may vary across environments and Microsoft Graph versions.

Step 3: Map category to PSA issue type

Afterward, you must match the alert category to a PSA issue type. Use the following as a reference:

Note: Exact mappings may differ by PSA system.

Step 4: Construct the JSON payload

Using the examples above, a generic JSON payload could look like this. Adjust the field names and values to match your PSA API requirements:

Method 3: Trigger webhook or API call to PSA system

This method sends formatted Defender alert data to a PSA API or webhook for ticket creation.

1. Press Win + R, type PowerShell, then click Run as administrator.
2. Copy and paste the following script into the prompt, then press Enter to send a ticket using PowerShell and a webhook:

Invoke-RestMethod -Method Post -Uri $psaWebhookUrl -Body
($alertJson | ConvertTo-Json -Depth 5) -ContentType “application/json”

Note: $psaWebhookUrl and $alertJson are placeholders and should be replaced with your actual PSA webhook endpoint and a properly formatted JSON payload.

For systems with token-based API access:

• Authenticate via REST token
• Use HTTP POST to /tickets endpoint
• Confirm response status 200/201 and ticket ID return

Tip: Log ticket creation locally or in event logs for traceability.

Method 4: Schedule alert polling with PowerShell or Azure automation

Configure this script to run every 5 to 15 minutes using a scheduling platform to retrieve and process recent alerts.

1. Press Win + R, type PowerShell, then click Run as administrator.
2. Copy and paste the following script into the prompt, then press Enter to detect and escalate new alerts every 5 to 15 minutes:

You can run this via:

• Azure Automation with managed identity
• Windows Task Scheduler on RMM-controlled endpoint
• NinjaOne scripting policy

Note: Before running this script, you must first connect using Connect-MgGraph and ensure the app has the correct permissions.

Method 5: Add a registry-based audit trail to escalated endpoints

Use Case: Record the time of the last alert escalation for endpoint audit checks

1. Log to the registry on the affected device during ticket creation.
2. Press Win + R, type PowerShell, then click Run as administrator.
3. Copy and paste the following script into the prompt, then press Enter:

This allows RMM agents to read the last recorded escalation time at the device level.

Warning: Writing to the registry could conflict with existing keys or policies. (For more info, refer to: Things to look out for)

Method 6: Use Group Policy to improve logging and alert context

This step provides future alerts with more context, making it easier to investigate issues.

1. Press Win + R, type gpedit.msc, then press Enter to open the Local Group Policy Editor.
2. Navigate to:

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Reporting

3. Configure the relevant Microsoft Defender Antivirus reporting policies required for your environment:
   • Send alert information to Microsoft Defender for Endpoint
   • Monitor and log detected threats

Apply audit policies

1. Navigate to:

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies> Object Access

2. Enable the following to enrich alert telemetry:
   • Audit File System (Logging for file deletion).
   • Audit Registry (Registry changes).
3. Then, navigate to:

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking > Audit Process Creation

4. Enable Process execution

Warning: Enabling detailed audit policies increases log size. (For more info, refer to: Things to look out for)

Things to look out for

Additional considerations

The following practices ensure your PSA handles security alerts with precision across multi-tenant environments.

De-duplication

Prevent duplicate tickets by checking the alert ID in a cache or database before creating a new one. This helps stop ticket floods from repeated alerts.

Alert lifecycle

Keep PSA ticket status synchronized with relevant Defender alert status changes based on defined mapping rules. This improves incident traceability and reduces ticket clutter.

Multi-tenant awareness

Include context, such as tenant ID or client name, to ensure tickets are associated with the correct client, tenant, or site in multi-tenant environments.

Data retention

Preserve alert-to-ticket mapping to maintain maps between Defender alert IDs and PSA ticket IDs for compliance, auditing, or incident review. Data retention also enables deeper analytics on threat patterns and PSA responsiveness.

Troubleshooting common alert escalation issues

Below are common issues in Defender-to-PSA integrations, along with their solutions.

Graph API fails

If you can’t retrieve alerts from Defender or encounter similar errors, the likely culprits are expired tokens or an incorrect API endpoint. Ensure you use the correct endpoint format to resolve the issues.

Webhook timeouts

If a webhook request fails or a ticket does not appear in the PSA, verify the webhook URL, network connectivity, authentication, payload format, and HTTP response returned by the PSA. These checks can help identify connectivity, configuration, or API-related issues that may prevent successful ticket creation.

Duplicate tickets

Duplicate PSA tickets can occur when the alert or incident ID isn’t tracked after the first ticket creation. Always check if the alert has escalated before creating a new ticket to avoid duplication.

Ticket not visible

Some tickets are hard to locate or appear under a different queue because they were created on the wrong board, queue, or service desk. In this case, the best course of action is to confirm that the required fields are included and correctly mapped.

NinjaOne services that strengthen alert escalation automation

MSPs can use NinjaOne to automate endpoint workflows, execute scripts, generate alerts, and support ticketing workflows across managed environments. Some services that strengthen alert escalation automation include:

• Script scheduling and delivery: Run Microsoft Graph query and ticket escalation scripts across client tenants.
• Webhook triggers: Integrate directly with ticketing or Slack channels for alert forwarding.
• Custom endpoint monitoring: Use scripts or supported monitoring conditions to check device-level escalation indicators.
• Alert policy control: Use NinjaOne to determine which alerts require escalation, suppression, or remediation.
• Centralized visibility: Monitor managed endpoints, triggered conditions, and automation activity through NinjaOne dashboards..

For MSPs looking to centralize and automate this workflow, learn more in the NinjaOne RMM FAQ.

Eliminate manual alert monitoring by automating alert escalation

Automating alert escalation from Defender to PSA platforms can help MSPs operationalize detection and response workflows. Automation reduces manual alert monitoring overhead and supports documented escalation, while service-level tracking can be applied through the PSA when configured.

Related topics:

• Cloud Incident Response: Best Practices in 2026
• How to Automate Vulnerability Management
• Complete Guide: What Is IT Crisis Management?
• What is Professional Services Automation (PSA) Software?
• PSA vs RMM? So What’s the Difference?