azureblog.co.uk
← cd ~/licences
// licences · sku

Defender_Threat_IntelligenceDefender Threat Intelligence

Defender_Threat_Intelligence is the SKU part number Microsoft uses for Defender Threat Intelligence. You'll see it in Graph, PowerShell, licence reports and group-based licensing errors.

Product nameDefender Threat Intelligence
String ID (SkuPartNumber)Defender_Threat_Intelligence
GUID (SkuId)a9c51c15-ffad-4c66-88c0-8771455c832d
Service plans1

Service plans included (1)

Service planNameID
THREAT_INTELLIGENCE_APPDefender Threat Intelligencefbdb91e6-7bfd-4a1f-8f7a-d27f4ef39702

Is it in your tenant?

powershell3 lines
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "Defender_Threat_Intelligence" |
    Select-Object SkuPartNumber, ConsumedUnits, @{ n = "Purchased"; e = { $_.PrepaidUnits.Enabled } }

Assign it to a user

For more than a handful of people, use group-based licensing instead. The user needs a usage location set first.

powershell3 lines
Connect-MgGraph -Scopes "User.ReadWrite.All"
Set-MgUserLicense -UserId "jane.doe@contoso.com" `
    -AddLicenses @{ SkuId = "a9c51c15-ffad-4c66-88c0-8771455c832d" } -RemoveLicenses @()

Who has it?

powershell4 lines
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq a9c51c15-ffad-4c66-88c0-8771455c832d)" `
    -ConsistencyLevel eventual -CountVariable n -All |
    Select-Object DisplayName, UserPrincipalName

Search all 620 SKUs →

Sources