Previously, Microsoft Defender Threat Intelligence (MDTI) was offered as a separate product and portal experience. Organizations that wanted access to the full Defender TI capabilities required an additional premium license, which could cost tens of thousands of dollars per year depending on licensing and user count.
Instead of maintaining a separate portal for threat intelligence investigations, Microsoft has embedded its global threat intelligence directly into the daily workflows of SOC analysts, incident responders, and threat hunters.
The Evolution of Microsoft Defender Threat Intelligence
Microsoft Defender Threat Intelligence (MDTI) has evolved significantly over the past few years. Following Microsoft’s acquisition of RiskIQ, the service transitioned from a standalone RiskIQ product to a dedicated Microsoft Defender Threat Intelligence experience within Microsoft Defender. Today, that evolution is complete, with MDTI fully integrated into the native capabilities of Microsoft Defender and Microsoft Sentinel, making threat intelligence an embedded part of the investigation workflow at no additional cost.
RiskIQ (standalone) → Microsoft Defender Threat Intelligence (separate experience) → Native capabilities in Defender XDR & Microsoft Sentinel.
Microsoft combines finished intelligence, such as threat actor profiles, intelligence reports, and Threat Analytics, with raw intelligence including passive DNS, WHOIS, SSL certificates, internet infrastructure, and indicators of compromise.
What has Changed?
The standalone MDTI experience has been retired. Threat intelligence capabilities are now embedded directly into Microsoft Defender XDR and Microsoft Sentinel. Analysts no longer need to switch between portals to investigate infrastructure, threat actors, campaigns, or vulnerabilities.
During an investigation, analysts can immediately view:
- Threat actor attribution
- Associated malware families
- Campaign information
- Known malicious infrastructure
- MITRE ATT&CK techniques
- Threat Analytics reports
- Related vulnerabilities
- Microsoft recommendations
Licensing model
One of the biggest changes is the licensing model. Defender Threat Intelligence Premium capabilities, including the Defender TI Premium API, are now included for eligible Microsoft Defender customers at no additional cost. The Microsoft Graph Threat Intelligence API is available as part of this integration, allowing organizations to automate IOC enrichment and threat intelligence lookups without requiring a separate Defender TI subscription.
Retirement of the standalone experience
Starting August 1, the standalone Microsoft Defender Threat Intelligence (MDTI) experience, including Intel Profiles, Intel Explorer, and Intel Projects, will be retired. Going forward, all MDTI capabilities will be available through the Threat Analytics section in the Microsoft Defender portal, replacing the previous Threat Intelligence tab.
Old page:
The new view in Defender
Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal. With this new change, all of the Defender TI premium features are available in the unified SecOps experience of the portal.
MDTI capabilities are now available throughout the Microsoft Defender portal. The Threat Intelligence menu provides direct access to Intelligence Explorer, Intel Profiles, Threat Analytics, and related investigation experiences.
Old link: https://security.microsoft.com/intel-explorer
New link: https://security.microsoft.com/threatintelligenceexplorer
In some tenants, the new Threat Intelligence view is not visible yet. If the new Threat Intelligence menu is not yet visible in your tenant, you can still access the experience directly by browsing to the new URL.
Old menu:
New menu:
All data is now available via the tabs, and the Threat Intelligence Explorer can be searched using the integrated search functionality across all threat intelligence data via the search feature across all of the TI data.
Show domain Threat intelligence
Each domain has its own dedicated Threat Intelligence page that exposes the available Microsoft threat intelligence data. Threat Intelligence for domains is visible via the domain entity page. The URL entity page shows limited data from the dataset.
Via: https://security.microsoft.com/url/threat-intelligence?url=google.com
The URL entity page provides only a subset of the available intelligence.
Opening the domain directly through the Threat Intelligence experience exposes significantly more information, including reputation, passive infrastructure, reports, WHOIS data, and related intelligence
https://security.microsoft.com/domains/threat-intelligence?urlDomain=go-note.net
Opening any domain by using this URL format displays the complete Threat Intelligence dataset for that domain.
The URL can be used to receive all the information for the Threat Intelligence domains. For full information of the dataset, use the domain entity page:
https://security.microsoft.com/domains/threat-intelligence?urlDomain=<DOMAINNAME> MDTI Sentinel Data Connector
Beginning August 1, the final phase of Microsoft Defender Threat Intelligence (MDTI) convergence will be generally available in the Defender portal and is available via the free Microsoft Threat Intelligence connector in Sentinel; all free and premium indicator feeds are synced via the MDTI connector. MDTI Premium has been retired, so all data is available through the free connector for Defender customers.
Currently, there is some confusion with the data connectors in the content hub for Defender TI:
Microsoft Defender Threat Intelligence is the old connector. Use the Threat Intelligence (NEW) connector.
The connector can be enabled from the Microsoft Sentinel Data connectors page. By default, the connector is not connected, and no indicators are getting synced to Microsoft Sentinel.
After enabling the connector, Microsoft synchronizes both the free and premium threat intelligence indicators into Sentinel, making them available for analytics rules, hunting, and correlation.
Microsoft Graph Threat Intelligence API
Microsoft Graph also exposes the Defender Threat Intelligence APIs, allowing organizations to integrate Microsoft threat intelligence into their own automation and security tooling.
And the good news compared with the previous Defender TI Premium APIs:
- No seperated licensing required
- No API endpoint changes
- No migration required
One of the most powerful ways to consume Microsoft Defender Threat Intelligence (MDTI) is through the Microsoft Graph Threat Intelligence API. Rather than manually searching the Defender Threat Intelligence portal, developers and security teams can programmatically access Microsoft’s threat intelligence data and integrate it into custom applications, SOAR playbooks, SIEM workflows, and incident response automation.
The API is available under the /security/threatIntelligence namespace in Microsoft Graph and provides access to a rich set of intelligence resources, including:
- Threat intelligence articles published by Microsoft researchers
- Threat actor and campaign intelligence profiles
- Vulnerability intelligence
- Passive DNS records
- WHOIS information
- SSL certificate details
- Internet trackers and cookies
- Host components and infrastructure metadata
This enables analysts to automatically enrich indicators of compromise (IOCs) such as domains, IP addresses, and hostnames with contextual intelligence from Microsoft’s global threat intelligence platform.
For example, during a phishing investigation, an automation workflow could extract a suspicious domain from a Microsoft Sentinel incident, query the Threat Intelligence API for passive DNS history, WHOIS records, SSL certificate information, and related infrastructure, and then append the results directly to the incident. This eliminates manual lookups and provides analysts with immediate context to accelerate investigations.
Like other Microsoft Graph APIs, authentication is performed using Microsoft Entra ID, and applications require the appropriate Microsoft Defender Threat Intelligence permissions and licensing before accessing these endpoints.
Some commonly used endpoints include:
| Endpoint | Description |
|---|---|
/security/threatIntelligence/articles | Retrieves Microsoft threat research articles |
/security/threatIntelligence/intelligenceProfiles | Returns threat actor, malware, and campaign profiles |
/security/threatIntelligence/vulnerabilities | Provides vulnerability intelligence |
/security/threatIntelligence/hosts/{host}/passiveDns | Retrieves passive DNS records for a host |
/security/threatIntelligence/hosts/{host}/whois | Retrieves WHOIS registration information |
The Microsoft Graph Threat Intelligence API extends the capabilities of the Defender Threat Intelligence portal by enabling organizations to build automated enrichment workflows, integrate intelligence into existing security operations, and incorporate Microsoft’s global threat intelligence directly into their own tools and processes.
More information: Threat analytics in Microsoft Defender – Microsoft Defender XDR | Microsoft Learn
Reputation for bad domain via API:
https://graph.microsoft.com/v1.0/security/threatIntelligence/hosts/<domain>/reputation
Other useful examples include;
GET https://graph.microsoft.com/v1.0/security/threatIntelligence/hosts/<DOMAIN>/reputation
GET /security/threatIntelligence/hosts/<DOMAIN>/whois
GET /security/threatIntelligence/hosts/<DOMAIN>/sslCertificatesThreat Intelligence Library
Microsoft has expanded the Threat Intelligence Library within Microsoft Defender by making threat actor profiles, intelligence reports, OSINT articles, MSTIC research, Microsoft Threat Protection research, and Indicators of Compromise (IoCs) available directly from the unified Defender experience.
Each Threat Actor profile now includes an Indicators (Preview) tab that provides associated IP addresses, domains, URLs, file hashes, and other indicators of compromise linked to the actor:
Conclusion
The convergence of Microsoft Defender Threat Intelligence into Defender XDR and Microsoft Sentinel represents one of the most significant improvements to Microsoft’s SecOps platform in recent years.
Organizations no longer need to purchase or operate a separate threat intelligence portal. Instead, Microsoft has embedded global threat intelligence directly into incident investigations, hunting workflows, Microsoft Sentinel, and the Microsoft Graph Threat Intelligence API. This unified approach reduces context switching, simplifies licensing, and enables security teams to automate enrichment and investigations using Microsoft’s continuously updated intelligence.
As Microsoft continues to converge security products into a single SecOps experience, Defender Threat Intelligence becomes not just a research portal, but a core capability that enriches investigations, powers automation, and delivers Microsoft’s global threat intelligence directly where analysts need it most.
Microsoft Defender Threat Intelligence: Native Defender Integration and API Access
