Unified, real-time threat insights at no additional cost with MDTI convergence into Microsoft Sentinel and Defender XDR
Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal, giving customers real-time Microsoft threat intelligence across detection, investigation, response, hunting, and automation at no additional cost. Announced last year, this unified SecOps experience reduces fragmented context and tool handoffs, creating a clearer path from threat signal to informed action.
Latest features converging
Entity enrichments: all the intel, right where you need it
Defender entity pages surface threat intelligence enrichments in the Threat Intelligence Insights tab for IP addresses, domains, URLs, and files. This unified view combines reputation data and scores, attributed reports, infrastructure relationships, services, certificates, DNS and WHOIS records, trackers, cookies, and sandbox analysis, helping analysts assess risk and investigate incidents without switching tabs. For more information, see View threat intelligence in entity pages.
Screenshot of the Threat Intelligence Insights tab under Threat Analytics in the Defender portal showing reputation risk.
Screenshot of the Threat Intelligence Insights tab under Threat Analytics in the Defender portal showing WHOIS records.
MDTI Sentinel data connectors and APIs
Microsoft Threat Intelligence data that previously required the Premium MDTI connector is now available through the free Microsoft Threat Intelligence connector in Sentinel, enabling free and premium indicator feeds through one setup. MDTI APIs are also available by default to Microsoft Defender XDR and Microsoft Sentinel customers, without a separate MDTI license SKU, so teams can enrich investigations through Sentinel or external SIEM, SOAR, and automation tools.
As a reminder, the API surface remains unchanged, and no customer migration is required. Customers do not need to perform endpoint mapping, code changes, tooling changes, or cutover activities.
Features previously released
Threat Intelligence Library
Microsoft’s threat actor profiles, intelligence reports, OSINT articles, MSTIC and MTP research, and indicators of compromise (IoCs) are now available through Threat Analytics in the Defender portal, at no additional cost beyond the existing license.
Screenshot of the Threat Analytics dashbaord in the Defender portal.
Threat Analytics Enhancements
Reports now bring together embedded IoCs, MITRE ATT&CK mappings, targeted industries, actor origins, and automatic incident correlation, so defenders can move from reading intelligence to applying it in investigations.
Screenshot of the Threat Analytics page in the Defender portal showing actor profile overview.
Case Linking
Security teams can link investigation cases directly to relevant IoCs, making it easier to document findings, collaborate across response workflows, and show how intelligence informed action.
Reference the table below to see the full list of features available with the MDTI convergence into Microsoft Defender XDR and Sentinel.
Chart showing full list of MDTI capabilities converged into Defender XDR and SentinelActions for existing MDTI customers
Starting August 1, the standalone MDTI pages (Intel Profiles, Intel Explorer & Intel Projects) will be retired. All MDTI capabilities will be accessible via the Threat Analytics tab in the Defender portal instead of the Threat Intelligence tab. No migration action is needed. Customers will now access the MDTI value via the Threat Analytics tab in the Defender portal instead of the Threat Intelligence tab. Explore our documentation for more details and reach out to your account team or partner if you need have questions or need assistance on how to reduce your current license and transition to this new unified threat intelligence experience in Defender XDR or Sentinel at no additional cost.
Get started
To access threat intelligence in the Microsoft Defender portal:
- Go to the Microsoft Defender portal and sign in.
- Use the Threat intelligence navigation menu to access Intelligence explorer and Intel profiles.
- Investigate entities enriched with threat intelligence by selecting IP addresses, domains, URLs, or files from incidents, alerts, or search results.
Microsoft