Microsoft recently announced a major change: Microsoft Defender Threat Intelligence (MDTI) is merging with Microsoft Defender XDR and Microsoft Sentinel. This move simplifies threat intelligence access and changes how organizations license these capabilities. The update, detailed in Message Center post MC1192257, affects IT leaders managing Microsoft 365 security licensing.
Key Licensing Changes
- Standalone MDTI Retiring: MDTI will no longer be sold separately. After August 1, 2026, access requires a Defender or Sentinel license.
- Included in Microsoft 365 E5: MDTI features will be part of the Microsoft 365 E5 security license, with no extra cost.
- No Additional Fees: Defender XDR and Sentinel users get MDTI capabilities without new charges, reducing reliance on third-party threat intel tools.
What Is MDTI?
MDTI is Microsoft’s threat intelligence platform. It provides data on threat actors, malware, and vulnerabilities. Previously, MDTI was a separate product. Now, it’s being integrated into Defender and Sentinel, making threat insights available directly in the tools security teams use.
Why the Convergence?
Microsoft aims to streamline security operations:
- Unified Threat Intelligence: Threat data will appear directly in Defender and Sentinel dashboards.
- No More Portal Switching: Threat reports and IoCs are now in the Defender portal.
- Faster Response: IoCs link to Sentinel cases, helping teams act quickly.
- Customer Feedback: Users asked for a simpler, integrated experience.
Licensing and Entitlements
The biggest shift is in how MDTI is licensed:
- No More Standalone Licenses: MDTI will be retired as a separate product.
- Bundled Access: Defender XDR and Sentinel now include MDTI features.
- E5 Customers Benefit Most: Microsoft confirms MDTI is included in E5 security plans.
- Sentinel Users: Access MDTI via a free connector. Some ingestion costs may apply.
Licensing Scenarios
| License Type | MDTI Access Post-Convergence |
|---|---|
| Microsoft 365 E5 | Included, no extra cost |
| Microsoft 365 E3 (no add-ons) | Not included |
| E5 Security Add-on or Defender P2 | Included |
| Microsoft Sentinel | Included via connector; ingestion fees may apply |
| Standalone MDTI | Retires August 1, 2026 |
Budget and Renewal Impact
- Cost Savings: No need for separate MDTI or third-party threat intel subscriptions.
- Better ROI: E5 now includes more features, improving value.
- E3 Customers: May need to upgrade or add Defender licenses.
- Renewal Planning: Coordinate with Microsoft to transition licenses.
- Tool Consolidation: Evaluate if existing threat intel tools are still needed.
What IT Leaders Should Do
- Review current licenses and eligibility.
- Plan transition before August 2026.
- Update internal documentation and APIs.
- Train SOC teams on new workflows.
- Evaluate third-party threat intel tools for redundancy.
Final Thoughts
This convergence simplifies licensing and boosts the value of Microsoft’s security offerings. For E5 and Sentinel users, it means more features without extra cost. For others, it’s time to assess licensing and plan the transition. Microsoft is making threat intelligence easier to access and more affordable, helping organizations improve security while managing budgets effectively.
MDTI Migration FAQs
Q. Will MDTI still be available as a standalone product?
A. No. MDTI will no longer be sold as a standalone product. The standalone offering will retire on August 1, 2026, and continued access will require a Microsoft Defender or Microsoft Sentinel license.
Q. Which Microsoft licenses include MDTI?
A. MDTI is included with:
- Microsoft 365 E5 (no additional cost)
- E5 Security Add-on or Microsoft Defender for Endpoint P2
- Microsoft Defender XDR Microsoft Sentinel (via a connector; ingestion fees may apply)
MDTI is not included with Microsoft 365 E3 unless additional security licenses are added.
Q. Do Microsoft 365 E5 customers need to take any action?
A. Generally, no. MDTI is already included in Microsoft 365 E5. However, organizations should confirm access and ensure security teams understand how to use MDTI within Defender and Sentinel.
Q. Are there additional costs for Microsoft Sentinel users?
A. MDTI access is available through a free connector, but standard Sentinel data ingestion and analytics costs may apply depending on how much data is processed.
Q. What happens if we currently use standalone MDTI?
A. Organizations using standalone MDTI should plan to transition to Defender XDR or Microsoft Sentinel before August 1, 2026. Early planning will help avoid service disruption and licensing gaps.
Q. Can MDTI replace third-party threat intelligence tools?
A. In many cases, yes. Because MDTI is now included with Defender and Sentinel, organizations may be able to retire overlapping third-party threat intelligence subscriptions. A review of existing tools is recommended before making changes.
