Defender Threat Intelligence Coming to Sentinel and Defender XDR at No Additional Cost

Microsoft Defender Threat Intelligence (MDTI) will be retired as a commercial offering on Aug. 1, 2026. However, most Microsoft customers will benefit from this change, as the technology within MDTI that was previously limited to licensed customers will be integrated into Sentinel and Defender XDR at no additional cost. 

In particular, customers will be able to include the full, threat intelligence reports and data from MDTI within the Defender XDR threat analytics dashboard, providing much deeper detail about specific threats than customers would have had access to before. This enhancement will arrive first for Defender XDR, and a similar set of capabilities will be available to Sentinel customers at a later date. (Microsoft has not announced a specific timeline.) In addition to threat intelligence, customers will also be able to access MDTI’s collection of indicators of compromise (IoCs) within Sentinel and Defender XDR, which should help accelerate analysis and detection of threats. In general, customers of Sentinel should get capabilities equivalent to those previously limited to MDTI commercial customers, while Defender XDR customers will receive a smaller but significant set of capabilities previously limited to MDTI commercial customers (see fig. 1). This continues Microsoft’s recent trend of aligning Sentinel and Defender XDR management, likely indicating an effort to increase development efficiency between the two independent but related offerings.