Microsoft adds Defender Experts Threat Intelligence and expands MDR beyond its own stack

Microsoft has added another managed-security layer to its Defender portfolio, announcing Microsoft Defender Experts Threat Intelligence and broader multi-cloud coverage for Defender Experts MDR. The July 15 announcement positions both changes around a familiar enterprise security problem: teams often have plenty of telemetry, but still struggle to decide which campaigns matter to their own environment and what response should come next.

The new Defender Experts Threat Intelligence service is described as an expert-delivered offering rather than just another threat feed. Microsoft says designated analysts will turn its global security signal into periodic, customer-specific guidance based on factors such as industry, geography and environment. The service is meant to provide early warnings about relevant campaigns, updates as attacker infrastructure and tactics change, and briefings that can be used by both executives and front-line defenders.

Defender intelligence moves into the portal

Microsoft also says Defender Threat Intelligence capabilities are now converged into the Defender portal. In practical terms, the company is trying to put intelligence closer to daily security workflows such as detection, investigation, response, hunting and automation, instead of forcing analysts to move between separate consoles while an incident is unfolding.

The second major change is an expansion of Microsoft Defender Experts MDR, the managed detection and response service formerly known as Defender Experts for XDR. Microsoft says the MDR service now supports third-party and multi-cloud coverage through Microsoft Sentinel, allowing its experts to correlate signals from non-Microsoft sources across cloud, identity, email, network and endpoint environments. Existing Defender Experts for XDR capabilities continue as Defender Experts MDR Plan 1, while Plan 2 extends triage, investigation and response beyond Microsoft-only deployments.

Why it matters

The announcement reflects where large security vendors are taking managed defense: less emphasis on raw alert volume and more on contextual, vendor-aware decision support. For Microsoft customers, the value will depend on how well the expert guidance maps to their actual exposure and whether Sentinel integrations can turn mixed-tool telemetry into a coherent incident story. The move also raises expectations for competing MDR and threat-intelligence providers, because enterprise buyers increasingly want intelligence that is tailored, operational and ready to act on, not just another report to read.

Sources

• www.microsoft.com

Cover photo by panumas nikhomkhai on Pexels, used under the Pexels License.