Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Connect Threat Intelligence Tip

4 September 2026Doc update+17 / −17 lines

In brief

The guidance now explicitly names the application ID, tenant ID, client secret, and Microsoft Graph tiIndicators API permission required for TIP integration with Microsoft Sentinel. Section headings and connector-enablement steps were also clarified.

What Defender admins need to know

Administrators configuring a TIP or custom solution can more easily identify the required credentials and permission and complete the Microsoft Sentinel connector setup.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

#Customer intent: As a security admin, I want to integrate my threat intelligence platform with Microsoft Sentinel to ingest threat intelligence, generating alerts and incidents so that I can centralize and enhance threat detection and response.

This data connector will be deprecated and will stop collecting data in June 2026. We recommend transitioning to the new Threat Intelligence Upload Indicators API data connector as soon as possible to ensure uninterrupted data collection. For more information, see Connect your threat intelligence platform to Microsoft Sentinel with the upload API.

Many organizations use threat intelligence platform (TIP) solutions to aggregate threat indicator feeds from various sources. From the aggregated feed, the data is curated to apply to security solutions such as network devices, EDR/XDR solutions, or security information and event management (SIEM) solutions such as Microsoft Sentinel. By using the TIP data connector, you can use these solutionsyour TIP solution to import threat indicators into Microsoft Sentinel.

Because the TIP data connector works with the Microsoft Graph Security tiIndicators API to import threat indicators, you can use the connector to send indicators to Microsoft Sentinel (and to other Microsoft security solutions like Defender XDR) from any other custom TIP that can communicate with that API.

  • Directory (tenant) ID
  • Client secret

You can get this informationthe application ID, tenant ID, and client secret from Microsoft Entra ID through app registration, which includes the following three steps:

  • Register an app with Microsoft Entra ID.
  • Specify the permissions required by the app to connect to the Microsoft Graph tiIndicators API and send threat indicators.
  • Get consent from your organization to grant thesethe Microsoft Graph tiIndicators API permissions to this application.

Register an application with Microsoft Entra ID

Register an app in Microsoft Entra ID to obtain the application ID and tenant ID needed for TIP integration. 

:::image type="content" source="media/connect-threat-intelligence-tip/threat-intel-register-application.png" alt-text="Screenshot that shows registering an application.":::
  1. On the screen that opens, copy the Application (client) ID and Directory (tenant) ID values. You need these two pieces of informationthe application ID and tenant ID later to configure your TIP or custom solution to send threat indicators to Microsoft Sentinel. The third piece of information you need, the client secret, comes later.

Specify the permissions required by the application

Grant the application the API permission it needs to send threat indicators.

  1. On the Select an API page, select the Microsoft Graph API. Then choose from a list of Microsoft Graph permissions.

  2. At the prompt What type of permissions does your application require?, select Application permissions. This permission is the typeApplication permissions are used by applications that authenticate with app ID and app secrets (API keys).

  3. Select ThreatIndicators.ReadWrite.OwnedBy, and then select Add permissions to add thisthe ThreatIndicators.ReadWrite.OwnedBy permission to your app's list of permissions.

    :::image type="content" source="media/connect-threat-intelligence-tip/threat-intel-api-permissions-1.png" alt-text="Screenshot that shows specifying permissions.":::

Get consent from your organization to grant these permissions

  1. To grant consent, a privileged role is required. For more information, see Grant tenant-wide admin consent to an application.

  2. Select Add, and then copy the client secret.

Enter the application ID, tenant ID, and client secret into your TIP solution or custom application

You now have all three pieces of information you need to configure your TIP or custom solution to send threat indicators to Microsoft Sentinel:

  1. For the action, specify alert.

After you finish configuring your TIP or custom solution with the application ID, tenant ID, and client secret, threat indicators are sent from your TIP or custom solution, through the Microsoft Graph tiIndicators API, targeted at Microsoft Sentinel.

Enable the TIP data connector in Microsoft Sentinel

The last step in the integration process is to enable the TIP data connector in Microsoft Sentinel. Enabling the TIP data connector allows Microsoft Sentinel to receive the threat indicators sent from your TIP or custom solution. These indicators are available to all Microsoft Sentinel workspaces for your organization. To enable the TIP data connector for each workspace, follow these steps:

  1. For Microsoft Sentinel in the Azure portal, under Content management, select Content hub.
    For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Content management > Content hub.

  2. Find and select the Threat Intelligence Platforms - BEING DEPRECATED data connector, and then select Open connector page.

  3. Because you already finished the app registration and configured your TIP or custom solution to send threat indicators, the only step left is to select Connect. to finish enabling the TIP data connector.

Within a few minutes, threat indicators should begin flowing into this Microsoft Sentinel workspace. You can find the new indicators on the Threat intelligence pane, which you can access from the Microsoft Sentinel menu.