THREAT_INTELLIGENCE License appeared in M365 Tenant

THREAT_INTELLIGENCE License appeared in M365 Tenant

Hi All,

This Week i received a Mail that a new Service Plan has addet to my Tenant.

Seems that my Azure Automation Runbook Keep Track of new ServicePlans in M365 Licenses finally pays out.

Let’s have a closer look

Write-Output "Connect-MgGraph"
Connect-MgGraph -Scopes User.ReadWrite.All, Directory.ReadWrite.All -NoWelcome

#Array with all needed Properties using PSCustomObject
Write-Output "Create PSCustomObject"
$ArraySKUS = @()
$SKUS = Get-MgSubscribedSku
Foreach ($SKU in $SKUS)
    #$ArraySKU = @()
    $AppliesTo = $SKU.AppliesTo
    $CapabilityStatus = $SKU.CapabilityStatus
    $SkuId = $SKU.SkuId
    $SkuPartNumber = $SKU.SkuPartNumber
	[array]$ServicePlans = $SKU.ServicePlans.ServicePlanName
    $ConsumedUnits = $SKU.ConsumedUnits
    $Enabled = $SKU.PrepaidUnits.Enabled
    $Suspended = $SKU.PrepaidUnits.Suspended
    $Warning = $SKU.PrepaidUnits.Warning
    $SKUObject = [PSCustomObject]@{
        AppliesTo             = $AppliesTo
        CapabilityStatus     = $CapabilityStatus
        SkuId                = $SkuId
        SkuPartNumber        = $SkuPartNumber
		ServicePlans		 = $ServicePlans
        ConsumedUnits        = $ConsumedUnits
        Enabled                = $Enabled
        Suspended            = $Suspended
        Warning                = $Warning
    $ArraySKUS += $SKUObject
$ArraySKUS | FT AppliesTo, CapabilityStatus, SkuId, SkuPartNumber, ConsumedUnits, Enabled, Suspended, Warning

$ArraySKUS[0] | fl

According to Product names and service plan identifiers for licensing it must this Licence (donwloaded the CSV and searched for the SkuId)

When looking in the M365 Admin Portal, that License is not visible

But it might be the “Defender Platform for Office 365”

The License is also not visible in Entra Admin Center…

…nor in the Defender for Office 365 Plan 2

It’s probably related to

Licensing in M365 is hard and still seems like a secret science 😂

Andres Bohren

M365 Logo