Using Microsoft Security APIs for Incident Response - Part 1

PeterJ_Inobits great questions!  based upon my personal experience you can indeed leverage APIs in PowerBI, but via individual account access instead of an OAuth application.  In PowerBI Desktop you can Get data > OData feed, and then for the URL you can use "https://api.securitycenter.microsoft.com/api/alerts".  Then for authentication there are several options, but the one you're likely going to want is "Organizational account" (see below).  For Defender for Identity, there's a couple of ways you can access the data.  The alerts and incidents are rolled up into M365D, but to get data via API you need to leverage the Microsoft Defender for Cloud Apps API.