← cd ~/licences
// licences · sku
IDENTITY_THREAT_PROTECTIONMicrosoft Defender Suite
IDENTITY_THREAT_PROTECTION is the SKU part number Microsoft uses for Microsoft Defender Suite. You'll see it in Graph, PowerShell, licence reports and group-based licensing errors.
| Product name | Microsoft Defender Suite |
|---|---|
| String ID (SkuPartNumber) | IDENTITY_THREAT_PROTECTION |
| GUID (SkuId) | 26124093-3d78-432b-b5dc-48bf992543d5 |
| Service plans | 8 |
Service plans included (8)
| Service plan | Name | ID |
|---|---|---|
MTP | Microsoft 365 Defender | bf28f719-7844-4079-9c78-c1307898e192 |
ATP_ENTERPRISE | Microsoft Defender for Office 365 (Plan 1) | f20fedf3-f3c3-43c3-8267-2bfdd51c0939 |
THREAT_INTELLIGENCE | Microsoft Defender for Office 365 (Plan 2) | 8e0c0a52-6a6c-4d40-8370-dd62790dcd70 |
SAFEDOCS | Office 365 SafeDocs | bf6f5520-59e3-4f82-974b-7dbbc4fd27c7 |
WINDEFATP | Microsoft Defender for Endpoint | 871d91ec-ec1a-452b-a83f-bd76c7d770ef |
AAD_PREMIUM_P2 | Microsoft Entra ID P2 | eec0eb4f-6444-4f95-aba0-50c24d67f998 |
ADALLOM_S_STANDALONE | Microsoft Defender for Cloud Apps | 2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2 |
ATA | Microsoft Defender for Identity | 14ab5db5-e6c4-4b20-b4bc-13e36fd2227f |
Is it in your tenant?
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "IDENTITY_THREAT_PROTECTION" |
Select-Object SkuPartNumber, ConsumedUnits, @{ n = "Purchased"; e = { $_.PrepaidUnits.Enabled } }Assign it to a user
For more than a handful of people, use group-based licensing instead. The user needs a usage location set first.
Connect-MgGraph -Scopes "User.ReadWrite.All"
Set-MgUserLicense -UserId "jane.doe@contoso.com" `
-AddLicenses @{ SkuId = "26124093-3d78-432b-b5dc-48bf992543d5" } -RemoveLicenses @()Who has it?
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq 26124093-3d78-432b-b5dc-48bf992543d5)" `
-ConsistencyLevel eventual -CountVariable n -All |
Select-Object DisplayName, UserPrincipalNameSimilar licences
These share the most service plans with IDENTITY_THREAT_PROTECTION.
SPE_F5_SECMicrosoft 365 F5 Security Add-on · 88% overlapIDENTITY_THREAT_PROTECTION_FOR_EMS_E5Microsoft 365 E5 Security for EMS E5 · 63% overlapTHREAT_INTELLIGENCEMicrosoft Defender for Office 365 (Plan 2) · 38% overlapSPE_F5_SECCOMPMicrosoft 365 F5 Security + Compliance Add-on · 29% overlapM365_SECURITY_COMPLIANCE_FOR_FLWMicrosoft 365 Security and Compliance for Firstline Workers · 27% overlap