11.4 Defender Threat Intelligence

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

11.4 Defender Threat Intelligence

Key Takeaways Explain This Topic AI

Microsoft Defender Threat Intelligence provides intel on threat actors, infrastructure, tooling, indicators of compromise (IOCs), and articles/profiles, accessible in the Defender portal and via the standalone Defender TI experience

Defender TI lets an administrator research an indicator (IP, domain, URL, file hash), understand adversary infrastructure, profile threat actors and TTPs mapped to MITRE ATT&CK, and pivot from an incident's indicators to threat context

Integrating TI into incident response means enriching alerts with intel and hunting across the organization for the same indicators found in an incident

Defender Threat Intelligence is research and enrichment — the actual detections come from the Defender XDR engines, not from TI itself

Threat actor profiles in TI include targets, regions, industries, and observed tooling, which helps prioritize which threats to prepare for

Last updated: August 2026

Quick Answer: Microsoft Defender Threat Intelligence (Defender TI) is a threat-intel platform that gives MS-102 administrators intelligence on threat actors, infrastructure, tooling, indicators of compromise (IOCs), and curated articles and profiles. Use it to research an indicator from an incident, enrich alerts with adversary context, and hunt for the same indicators across the organization. Defender TI is research and enrichment — the actual detections still come from the Defender XDR engines.

What Defender Threat Intelligence Provides

Defender TI aggregates Microsoft's internal threat-intelligence signals (from Defender XDR, Microsoft's research teams, and acquired intel sources) and exposes them as a searchable research platform. It is accessible both inside the Microsoft Defender portal and via the standalone Defender TI experience . The core content types are:

Indicators of compromise (IOCs) — IPs, domains, URLs, and file hashes with reputation and associated threat context.

Threat actor profiles — named groups with targeted industries, regions, targets, observed tooling, and TTPs mapped to MITRE ATT&CK.

Articles and reports — curated write-ups of campaigns, vulnerabilities, and adversary tradecraft.

Infrastructure — resolved DNS records, WHOIS, certificates, and hosting relationships that help analysts understand adversary infrastructure and pivot to related infrastructure.

Tooling — malware families and tools used by threat actors, with their associated IOCs.

Researching an Indicator

A typical Defender TI workflow starts with an indicator pulled from an incident — say, a suspicious destination IP from a Defender for Endpoint network event:

Search the IP in Defender TI to pull its reputation, associated articles, and linked infrastructure.

Pivot to related infrastructure: domains resolving to that IP, certificates sharing that IP, other IPs in the same hosting block.

Profile the threat actor or malware family tied to the indicator — its targets, TTPs, and known tooling.

Enrich the original alert with this context so the incident owner understands who is likely behind the activity and why it matters.

Hunt across the tenant for the same indicators and related infrastructure using advanced hunting, and add any new findings to the incident.

This pivot-from-incident flow is the most important behavior to understand for the exam, because it is how "review and respond to threats identified by Microsoft Defender Threat Intelligence" is actually operationalized.

Integrating TI With Incident Response

Defender TI is not a standalone research toy — it plugs into the incident workflow:

Enrichment — when an incident contains an indicator (IP, domain, URL, hash), TI provides context that helps the analyst decide severity and classification. An IP associated with a known ransomware delivery campaign changes the triage priority of an otherwise generic network alert.

Hunting — take the indicators from the TI article for an emerging threat and run an advanced hunting query across the tenant to see whether the organization has been targeted. This is the manual counterpart to the automatic threat-analytics detections.

Proactive profiling — review threat actor profiles whose targeting fits the organization's industry and region, then pre-stage detections or hunting queries for their known TTPs.

TI vs. In-Product Detections — the distinction the exam tests

This is the most common point of confusion in Domain 3's threat-intel objective, so get it straight:

Defender Threat Intelligence Defender XDR detection engines

What it is A research and enrichment platform The detection logic in Defender for Endpoint, Office 365, Identity, and Cloud Apps

• What it produces Context on indicators, actors, infrastructure, and TTPs Alerts and incidents
• Direction of use Analyst pulls intel into an investigation Engines push alerts out to the analyst

Example question it answers "Who is behind this IP, and what else do they use?" "Did something malicious happen on this device?"

A useful framing: Defender TI does not detect anything in your environment by itself. It tells you what an indicator means . The Defender XDR engines detect the activity; TI enriches it so you can respond at the right priority and hunt for related activity.

Threat Actor Profiles and MITRE ATT&CK

Defender TI threat actor profiles map observed behaviors to the MITRE ATT&CK framework, which is the de facto taxonomy of adversary tactics, techniques, and procedures. Each technique in an actor profile (for example, T1566 Phishing for initial access, or T1003 OS credential dumping for credential access) can be used to drive detection engineering and hunting — the same techniques map cleanly to advanced hunting tables and Defender XDR alert categories, which is why MITRE ATT&CK is the common vocabulary across the XDR stack.

A Note on Licensing and Access

Defender Threat Intelligence is licensed separately from the base Defender XDR workloads. For the MS-102 exam, the key facts are that Defender TI exists, that it provides actor/infrastructure/IOC/profile intelligence, that it is reachable from within the Defender portal as well as via a standalone experience, and that the detections themselves come from the Defender XDR engines — not from TI. The exam will test the role of TI in incident response, not the licensing matrix.