Microsoft is introducing a new threat intelligence experience in the Defender portal built around two pages: Overview and Intel explorer. The October 22 announcement says these pages replace the previous Threat Analytics and Intel management experiences. For security teams, the immediate work is to update analyst navigation, saved instructions, and investigation runbooks so people can find the same intelligence in its new layout.
This is a workflow change inside Microsoft Defender. Microsoft says existing threat intelligence carries over and that existing capabilities remain unless the transition documentation describes a change. The announcement does not state a cutover deadline or ask customers to migrate existing intelligence records.
What the two pages do
| Page | Use it for | Operational check |
|---|---|---|
| Overview | A starting view of current, high-impact, and high-exposure threats, with organization context such as relevant industries and regions. | Confirm the industries and geographies reflect your exposure profile, then use the linked intelligence to decide what deserves investigation. |
| Intel explorer | Searching, filtering, and investigating supported intelligence types across available Microsoft, connected third-party, and organization-curated sources. | Test representative searches for an actor, CVE, domain, or IP address and confirm the analyst can open the expected object details. |
| Entity details | Reviewing related intelligence and relationships attached to a selected object. | Update procedures that send analysts to a separate Relationships tab; Microsoft says relationship details now appear in the entity details experience. |
The new Overview helps teams start with threats that Microsoft considers relevant to their organization. It does not, by itself, prove that a tenant is compromised or that a specific indicator is present in local telemetry. Analysts should use the Explorer and the appropriate Defender investigation pages to validate evidence and exposure.
Update the analyst workflow
- Confirm who can see the experience. Microsoft says access requires an eligible Microsoft Defender license. Check the tenant's current entitlement and test with a standard analyst role as well as the security administrator account; do not assume that a portal menu visible to one role is available to everyone.
- Replace old portal paths in runbooks. Point analysts to Threat intelligence > Overview for prioritization and Threat intelligence > Intel explorer for search and investigation. Refresh screenshots, training notes, bookmarks, and any internal troubleshooting instructions that name Threat Analytics or Intel management.
- Map renamed object types. Microsoft Learn maps the former Technique type to Attack patterns, Actor to Threat actor, Activity to Campaign, and OSINT or Core threat to Report. Indicators and Identities keep their names. Update playbooks and analyst vocabulary where these labels appear.
- Check the relationships step. In the new experience, relationship information is in the selected entity's details rather than a separate Relationships tab. Test one known actor, campaign, vulnerability, and indicator so analysts can follow the connections they use during investigations.
- Validate sources and permissions. Compare a few known Microsoft reports, connected feeds, and organization-curated records before and after the workflow update. For Microsoft Sentinel threat intelligence management, Microsoft Learn says the operator needs the Sentinel Contributor role or higher.
Microsoft states that reports remain available in full detail and existing intelligence carries over. Keep your normal evidence-retention and case-record procedures in place: a new portal experience does not replace your organization's incident documentation or long-term records policy.
Keep the licensing distinction clear
The announcement describes access for customers with an eligible Microsoft Defender license. Microsoft Learn separately says publicly available Microsoft Threat Intelligence data is available to Microsoft Defender XDR customers at no additional cost, while managing Microsoft Sentinel threat intelligence requires Sentinel permissions. Those statements describe different access paths; they do not establish that every intelligence source, connected feed, or Sentinel capability is included in every license.
Before changing access or budget assumptions, verify the products and service plans assigned to the tenant and the roles granted to each analyst. The broader Defender ISOC preview has separate workspace, ingestion, and retention considerations; see our ISOC planning guide for that related operating-model change.
Frequently asked questions
Do we need to migrate our existing threat intelligence records? Microsoft says existing intelligence carries over to the new experience. Update the analyst workflow and verify representative records and sources; follow Microsoft's current transition documentation for any capability-specific exception.
Did Microsoft announce a deadline to move? The October 22 post does not specify a new cutover deadline. It says the new Overview and Explorer replace the previous Threat Analytics and Intel management pages, so teams should update their procedures as the new experience becomes available to them.
Does the Overview confirm that a threat affects our tenant? No. It highlights threats Microsoft considers relevant using organization context. Investigators should validate exposure using available Defender evidence and the related intelligence objects.
Is the new experience the same as Defender ISOC? The threat intelligence pages are described as part of Microsoft's Integrated Security Operations Center release, but the navigation and investigation workflow is a distinct change. Workspace creation, non-Microsoft data ingestion, and Sentinel operating decisions have additional ISOC-specific considerations.
Need a clearer security operations workflow?
Accred Consulting helps growing organizations document Microsoft 365 security responsibilities, role boundaries, and repeatable operating procedures.
Plan a Security Review