[m365_defender] Remove nonexistent scope config from vulnerability setup

[kcreddy]

Proposed commit message

[m365_defender] Remove nonexistent scope config from vulnerability setup

The setup instructions for the "Collect vulnerabilities using Microsoft
Defender for Endpoint API" method told users to "Configure either
Subscription ID or Management Group Name as the scope", but the
integration exposes no such configuration options. The vulnerability
data stream's cel input only declares Client ID, Client Secret, and
Tenant ID, and its registration steps list only those three. The scope
sentence was a copy-paste from an Azure-style integration and is not
followable as written.

Remove the sentence so the step matches its sibling (Microsoft Graph
Security API) and the registration instructions above it. Docs-only
change; no data stream, field, or pipeline behavior is affected.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

Screenshots

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[Copilot]

Pull request overview

Removes an incorrect setup instruction in the Microsoft Defender XDR integration documentation for the “Collect vulnerabilities using Microsoft Defender for Endpoint API” method, aligning the written steps with the actual configuration fields exposed by the integration.

Changes:

• Remove the incorrect “Subscription ID / Management Group Name” scope instruction from the vulnerability collection setup step.
• Bump the package patch version to reflect the documentation correction.
• Add a changelog entry describing the documentation fix.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
packages/m365_defender/manifest.yml	Bumps package version from 5.15.1 to 5.15.2.
packages/m365_defender/docs/README.md	Removes the incorrect scope configuration instruction from the vulnerability setup step.
packages/m365_defender/changelog.yml	Adds a 5.15.2 entry for the documentation fix (link currently incorrect).
packages/m365_defender/_dev/build/docs/README.md	Mirrors the same docs correction in the built docs output.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

🟢 No issues across the latest commits c239ad1.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.2.6 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: c239ad1

cc @kcreddy

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package m365_defender - 5.15.2 containing this change is available at https://epr.elastic.co/package/m365_defender/5.15.2/