---
title: Domain separation in Microsoft Defender for Endpoint integration
description: Domain separation is supported in Microsoft Defender for Endpoint integration. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/domain-separation-in-ms-defender-endpoint-integration.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Microsoft Defender for Endpoint integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Domain separation in Microsoft Defender for Endpoint integration

Domain separation is supported in Microsoft Defender for Endpoint integration. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.

## Support level

Support: Basic

Use the following steps for domain separation:

1.  Create a user with the sn\_si.admin role in the respective domain.
2.  Perform the Microsoft Defender for Endpoint integration procedures in the appropriate domain.