MC1192257 High Major change
(Updated) Microsoft Defender Threat Intelligence: Convergence with Microsoft Defender and Microsoft Sentinel
Summary AI-generated
MDTI is merging with Defender and Sentinel; by Aug 1, 2026, MDTI features will need Defender or Sentinel licenses and new APIs will replace old MDTI APIs.
Suggested actions AI-generated
- Plan transition to Defender or Sentinel
- Review MDTI licensing needs
- Update documentation for new APIs
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1187386 Microsoft Defender for Identity alerts transitioning to XDR-based detection platform
- MC1220762 (Updated) Retirement notice: MDE and XDR Advanced Hunting APIs retiring; migrate to Microsoft Graph Security API
- MC1077861 (Updated) Microsoft Defender for Cloud Apps: SIEM agents will retire
- MC1381119 Microsoft Defender for Endpoint security updates move to Microsoft Update on Windows
- MC1234542 Retirement of “Suspected identity theft (pass-the-ticket)” classic alert
- MC1381122 Microsoft Defender XDR: Retirement of in-app OS update notifications in Defender for Endpoint (iOS)
Original post from Microsoft
Updated December 5, 2025: We have updated the timeline. Thank you for your patience.
[Introduction]
Microsoft Defender Threat Intelligence (MDTI) is converging with Microsoft Defender and Microsoft Sentinel to deliver integrated threat intelligence capabilities directly within your SecOps environment. This change simplifies access to threat insights, improves detection and response workflows, and aligns with customer feedback for a unified experience.
[When this will happen]
Full convergence will be completed by August 1, 2026. New capabilities are available now, and as of August 2025, all MDTI data has been published via the free connector, with new Threat Analytics APIs replacing retired MDTI APIs.
[How this affects your organization]
Who is affected: Organizations using Microsoft Defender Threat Intelligence, Microsoft Defender, or Microsoft Sentinel.
What will happen:
- Threat Intelligence Library will be accessible via the Microsoft Defender portal, including exclusive threat reports, intel profiles, and Indicators of Compromise (IoCs) integrated into Threat Analytics.
- Enhanced Threat Analytics reports will include:
- Indicators of Compromise (IoCs) embedded in reports.
- MITRE ATT&CK mapping for tactics, techniques, and procedures.
- Insights on targeted industries and actor origins.
- Related intelligence and aliases for cross-referencing.
- IoCs will be linked to cases for Sentinel customers.
- After August 1, 2026, MDTI capabilities will require an active Microsoft Defender or Microsoft Sentinel license.
[What you can do to prepare]
- Plan your transition to Microsoft Defender or Microsoft Sentinel before August 1, 2026, to maintain uninterrupted access.
- Review licensing requirements for MDTI capabilities.
- Update internal documentation to reflect new Threat Analytics APIs and connector availability.
[Compliance considerations]
No compliance considerations identified, review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Microsoft Defender Threat Intelligence is merging with Microsoft Defender and Microsoft Sentinel by August 1, 2026, offering integrated threat insights and enhanced analytics. Post-transition, MDTI requires an active Defender or Sentinel license. Organizations should prepare by updating licenses, documentation, and transitioning before the deadline.