← cd ~/licences
// licences · sku
THREAT_INTELLIGENCEMicrosoft Defender for Office 365 (Plan 2)
THREAT_INTELLIGENCE is the SKU part number Microsoft uses for Microsoft Defender for Office 365 (Plan 2). You'll see it in Graph, PowerShell, licence reports and group-based licensing errors.
| Product name | Microsoft Defender for Office 365 (Plan 2) |
|---|---|
| String ID (SkuPartNumber) | THREAT_INTELLIGENCE |
| GUID (SkuId) | 3dd6cf57-d688-4eed-ba52-9e40b5468c3e |
| Service plans | 3 |
Service plans included (3)
| Service plan | Name | ID |
|---|---|---|
MTP | Microsoft 365 Defender | bf28f719-7844-4079-9c78-c1307898e192 |
ATP_ENTERPRISE | Microsoft Defender for Office 365 (Plan 1) | f20fedf3-f3c3-43c3-8267-2bfdd51c0939 |
THREAT_INTELLIGENCE | Microsoft Defender for Office 365 (Plan 2) | 8e0c0a52-6a6c-4d40-8370-dd62790dcd70 |
Is it in your tenant?
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "THREAT_INTELLIGENCE" |
Select-Object SkuPartNumber, ConsumedUnits, @{ n = "Purchased"; e = { $_.PrepaidUnits.Enabled } }Assign it to a user
For more than a handful of people, use group-based licensing instead. The user needs a usage location set first.
Connect-MgGraph -Scopes "User.ReadWrite.All"
Set-MgUserLicense -UserId "jane.doe@contoso.com" `
-AddLicenses @{ SkuId = "3dd6cf57-d688-4eed-ba52-9e40b5468c3e" } -RemoveLicenses @()Who has it?
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq 3dd6cf57-d688-4eed-ba52-9e40b5468c3e)" `
-ConsistencyLevel eventual -CountVariable n -All |
Select-Object DisplayName, UserPrincipalNameSimilar licences
These share the most service plans with THREAT_INTELLIGENCE.
IDENTITY_THREAT_PROTECTION_FOR_EMS_E5Microsoft 365 E5 Security for EMS E5 · 60% overlapSPE_F5_SECMicrosoft 365 F5 Security Add-on · 43% overlapIDENTITY_THREAT_PROTECTIONMicrosoft Defender Suite · 38% overlapATP_ENTERPRISE_FACULTYMicrosoft Defender for Office 365 (Plan 1) Faculty · 33% overlapATP_ENTERPRISE_STUDENTMicrosoft Defender for Office 365 (Plan 1) Student · 33% overlapATP_ENTERPRISE_STUDENTS_USE_BENEFITMicrosoft Defender for Office 365 (Plan 1) Student use benefit · 33% overlapATP_ENTERPRISE_USGOV_GCCHIGHMicrosoft Defender for Office 365 (Plan 1)_USGOV_GCCHIGH · 33% overlapATP_ENTERPRISEMicrosoft Defender for Office 365 (Plan 1) · 33% overlap