MDTI Convergence Is Complete: Premium Threat Intelligence, Now Included

The Short Version

The final phase of Microsoft Defender Threat Intelligence (MDTI) convergence went GA on August 1. Threat intelligence that used to sit behind a premium per-seat license is now included in the Defender portal for Defender XDR and Sentinel customers - at no extra cost.

For those of us who've had to explain to clients why the premium MDTI price tag was hard to justify, this is a genuinely good day. Here's what actually changed and what you should check in your tenants.

What You Get Now

• Threat Intelligence Insights on entity pages - IP, domain, and URL entity pages now include a TI Insights tab with reputation, WHOIS, DNS, certificates, sandbox analysis, and more. No more pivoting to a separate tool mid-investigation.
• Threat Analytics, upgraded - actor profiles, intel reports, OSINT, and MSTIC research now live under the Threat Analytics tab, with IoCs attached. Reports combine indicators, MITRE ATT&CK mappings, targeted industries, and actor origins, with automatic correlation to your incidents.
• MDTI APIs included by default - no separate license required for Defender XDR and Sentinel users. If you skipped building TI enrichment automation because of licensing, that blocker is gone.
• Investigation linking - teams can link investigations directly to IoCs, which makes response documentation less of an afterthought.

The Sentinel Connector Change

In Sentinel, the free Microsoft Threat Intelligence connector replaces the premium connector, consolidating the free and premium feeds into one setup. Microsoft says no migration or technical changes are needed - no code updates, no remapping, no tooling changes.

"Free connector" doesn't mean "free data", though. Indicators ingested into your workspace still count as billable ingestion like everything else. If you're switching on the consolidated feed across client tenants, keep an eye on the volume:

// What is threat intel ingestion costing you?
Usage
| where TimeGenerated > ago(30d)
| where DataType == "ThreatIntelligenceIndicator"
| summarize IngestedGB = sum(Quantity) / 1024

What's Being Retired

The standalone MDTI experience is going away. Starting August 1, the dedicated Intel Profiles, Intel Explorer, and Intel Projects pages are retired, and everything is centralized under the Threat Analytics tab in the Defender portal.

If your analysts have bookmarks, runbooks, or training material pointing at the standalone pages, update them now. The capabilities aren't disappearing - they're moving - but "the page you documented no longer exists" is a bad way for an analyst to start an incident.

What This Means for Multi-Client Environments

If you manage Sentinel or Defender for multiple clients, the practical wins are:

• One less licensing conversation - you no longer have to scope premium MDTI seats per analyst per client
• Consistent TI across tenants - every tenant gets the same enrichment, not just the ones that paid for it
• API-driven enrichment for everyone - automation you built for one client can now roll out to all of them

The Checklist

1. Check your Sentinel data connectors - confirm the Microsoft Threat Intelligence connector is enabled and the old premium connector setup is cleaned up
2. Review TI ingestion volume - run the Usage query above per tenant so the "free" upgrade doesn't surprise anyone's bill
3. Update analyst documentation - replace links to standalone MDTI pages with Threat Analytics
4. Revisit shelved enrichment ideas - anything you didn't build because of MDTI licensing is now worth a second look

My Two Cents

Consolidation announcements usually mean "we renamed three things and broke your bookmarks". This one actually removes a paywall from capabilities that should have been baseline all along. Real-time threat intelligence in the portal where analysts already work, without a licensing matrix - that's the version of "unified SecOps" worth having.

The caveat is the usual one: watch your ingestion, verify the connector behaves in each tenant, and don't assume "no migration needed" means "nothing to check".

References

• What is Microsoft Defender Threat Intelligence?
• Threat analytics in Microsoft Defender XDR
• Threat intelligence in Microsoft Sentinel