Microsoft expands Defender Experts for faster security action

Introduction

Microsoft is expanding its managed security offerings to help organizations close the gap between seeing a threat and acting on it. For IT and security teams dealing with high alert volumes, fragmented tooling, and multi-cloud environments, these updates are designed to deliver more context, less noise, and faster response.

What’s new

New: Microsoft Defender Experts Threat Intelligence

Microsoft announced Defender Experts Threat Intelligence, a new expert-delivered service that provides tailored, actionable threat intelligence instead of raw feeds or static reports.

Key capabilities include:

• Early-warning alerts on emerging campaigns relevant to your organization
• Campaign-evolution updates as attacks develop
• Intelligence tailored to your industry, geography, and environment
• Recurring briefings from designated Microsoft experts
• Guidance for both technical teams and executive stakeholders

The goal is to help organizations reduce risk before an attack reaches their environment.

Microsoft Defender Threat Intelligence now integrated into Defender

Microsoft also said that Microsoft Defender Threat Intelligence (MDTI) capabilities are now fully integrated into the Defender portal.

This means defenders can access threat intelligence across:

• Detection
• Investigation
• Response
• Hunting
• Automation

By bringing intelligence directly into daily SecOps workflows, Microsoft aims to reduce context switching and speed up decision-making.

Defender Experts MDR expands to third-party and multi-cloud

Microsoft is also expanding Defender Experts MDR with new third-party and multi-cloud coverage, powered by Microsoft Sentinel.

Highlights include:

• 24/7 monitoring and investigation by Microsoft experts
• Correlation across Microsoft and non-Microsoft security signals
• Cross-platform incident narratives with vendor-aware guidance
• Recommendations for detection tuning, integrations, and Sentinel content management
• Business-focused summaries of risks, posture gaps, and improvements

Microsoft noted that the new coverage is available in Defender Experts MDR Plan 2, while existing Defender Experts for XDR capabilities continue as Plan 1.

Why this matters for administrators

For security operations teams, the biggest benefit is broader visibility with expert-led interpretation. Organizations using mixed security stacks or operating across cloud, identity, endpoint, email, and network tools may now get more unified incident handling without relying solely on Microsoft-native telemetry.

The Defender portal integration is also important for analysts who want intelligence embedded directly into investigations instead of switching between separate tools.

Next steps

Security leaders and administrators should:

• Review whether current SOC workflows would benefit from expert-led threat intelligence briefings
• Evaluate Defender Experts MDR Plan 2 if you use third-party security tools or multi-cloud environments
• Assess Microsoft Sentinel readiness for broader data integration and response workflows
• Train analysts on the new MDTI experience in the Defender portal

These changes show Microsoft is pushing toward a more unified, human-led managed defense model that combines platform telemetry with expert action.