The Defender Threat Intelligence Portal Is Gone. Check Your Runbooks and Your Invoices.
The standalone Microsoft Defender Threat Intelligence portal retired on August 1, 2026, and Premium TI capabilities are now bundled into Defender XDR and Sentinel at no extra cost. Here is what MSPs need to check in runbooks, licensing, and automation.
August 1, 2026 came and went, and with it the standalone Microsoft Defender Threat Intelligence portal. If your team still has ti.defender.microsoft.com bookmarked, or a client onboarding doc that walks a junior analyst through Intel Explorer, that link is now dead. Microsoft has folded the whole experience into the Threat intelligence menu inside security.microsoft.com, alongside Defender XDR and Sentinel.
For an MSP running dozens of tenants, that is a documentation problem before it is anything else.
What actually changed
- Intel profiles, Intel explorer, and Threat analytics reports now live under Threat intelligence in the Defender portal itself, not a separate site.
- Entity pages for IPs, domains, URLs, and files get threat intelligence enrichment inline, through a Threat Intelligence Insights tab.
- Premium capabilities, including the Defender TI Premium API, are now included for eligible Defender XDR and Sentinel customers at no additional cost. MDTI is no longer sold as a standalone SKU.
Three things worth doing this week
- Sweep every runbook, wiki page, and client facing SOC doc for the old portal URL and swap in the new location.
- Pull your license list. If a client is still carrying a standalone MDTI subscription, that spend no longer buys anything the bundled license does not already include. Flag it for the next true up conversation rather than waiting for a renewal notice to surprise them.
- Re-run any script, connector, or SOAR playbook that calls the threat intelligence API and confirm it still authenticates and returns data now that the old endpoint is gone.
While you are auditing that board, add one more line item: the separate retirement of the MDE and Defender XDR Advanced Hunting APIs, with a hard migration deadline of January 31, 2027 to the Microsoft Graph Security API. No automatic migration there either, so it belongs on the same tracker rather than a different one.
Two portal changes, one API deadline, and a licensing line worth catching before the next renewal. Which tenants on your list are still pointing at the old TI portal?