Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
General

Threat Intel Briefing Agent Defender

4 September 2026Doc update+13 / −11 lines

In brief

The documentation now labels required products explicitly, clarifies that the recommended agent identity is a service principal, and adds more detail on obtaining a Microsoft Graph token, registering the service principal, and verifying it.

What Defender admins need to know

Administrators configuring the agent have clearer identity and Microsoft Graph setup instructions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Threat intelligence analysts face many challenges when they create useful, actionable briefings. Building a briefing requires collecting data from multiple threat feeds, tools, and portals. Analysts must then filter, correlate, and analyze this data to map risks to their organization. All of this work happens before they can even start writing the report. Because these steps can take hours or even days, threats often change before the briefing is ready, which can make itthe briefing outdated.

The Microsoft Security Copilot Threat Intelligence Briefing Agent in Microsoft Defender addresses these pain points. It generates threat intelligence briefings based on the latest threat actor activity and both internal and external vulnerability information in a matter of minutes. It can help security teams save time by creating a customized, relevant report that provides CISOs, security managers, and analysts with key situational awareness and a solid foundation for defense work.

The agent uses automation and generative AI along with broad threat intelligence data. As it builds the briefing, it picks each next step based on the result of the previous one. This lets it decide in real time which threats to include and rank. The agent then turns the collected threat intelligence and vulnerability findings into a clear report that different audiences can read and act on.

The Threat Intelligence Briefing Agent is best suited for customers who turn on Microsoft Defender for Endpoint and Microsoft Defender External Attack Surface, as the agent relies on signals and insights from these first-party integrations to deliver accurate and context-rich reports. Before you get started, review the prerequisites to ensure you have the required products, plugins, and permissions in place.

Watch this video to see the Threat Intelligence Briefing Agent in action, from setup to generating your first briefing.

[!VIDEO https://learn-video.azurefd.net/vod/player?id=07ffea67-4ebf-4f13-9a7e-dcc49bcaac93]

Before you set up the Threat Intelligence Briefing Agent, make sure you have the following products, plugins, and permissions in place.

ProductsRequired products

You need Microsoft Security Copilot to run this agent.

Security Copilot plugins

User account permissions

The user account connected to the agent or the created agent identity must have these permissions:

Agent trigger

This agent runs at the set time interval that you configured during setup, or manually when you want to run it.

Set up an agent identity for the agent

A service principal is an application identity in Microsoft Entra ID that lets an app access resources on its own behalf. The Threat Intelligence Briefing Agent can run under a dedicated agent identity (service principal) with only the minimal read permissions required in Microsoft Defender. This section describes how you can create or reuse a least-privileged role, register the agent's service principal, and assign the least-privileged role.

Before setting up an agent identity for the Threat Intelligence Briefing Agent, make sure that you have the agent in your environment. You must also have the following prerequisites:

  1. Register the agent's service principal (agent identity)

    First, get a Microsoft Graph access token. You use thisThe following Azure CLI command retrieves a Microsoft Graph bearer token to authenticate the API callsthat you reuse in the following steps.subsequent curl requests to register the service principal. Run the following commandscommand as a tenant admin:

    TOKEN=$(az account get-access-token \
   --query accessToken -o tsv)

    Next, createregister the service principal for the agent identity in your tenant:tenant by sending a POST request to Microsoft Graph. This request creates the service principal object that the agent uses to authenticate:

    curl -X POST https://graph.microsoft.com/v1.0/servicePrincipals \
      "appId": "43d7b169-1d9e-4d32-8cd8-06c5974ed90c"
   }'

    Optional: RunTo verify that the service principal was created successfully, run the following GET request. This request to look upqueries Microsoft Graph for the service principal by app ID and confirm it was created:returns its details so you can validate the setup before proceeding:

    curl -X GET "https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '43d7b169-1d9e-4d32-8cd8-06c5974ed90c'" \
  -H "Authorization: Bearer $TOKEN"