The Ministry of Defence has awarded Microsoft a contract worth just over £13.3 million covering access to the Microsoft Threat Analysis Centre from 2026 to 2028, the UK Defence Journal understands.
The award notice, published on 7 August 2026 under notice identifier 2026/S 000-075057, records a total final contract value of £13,320,612.30 excluding VAT, running for a period of two years. The award decision itself was taken on 1 April 2026, some four months before the notice appeared on the Find a Tender service.
Contracting was handled by Defence Digital, the MOD organisation responsible for the department’s information technology and digital services, which is headquartered at Abbey Wood in Bristol. Bristol is also listed as the place of performance for the services. The contract carries the reference number 715838561 and is titled “GCA Framework” in the award section of the notice.
Microsoft Ltd, based in Reading, was the sole bidder. The notice states that one offer was received, submitted by electronic means, and that a restricted procedure was used with lowest price as the award criterion. No electronic auction was held. The department does not expect the work to be subcontracted, and the contract is not linked to any project or programme financed by European Union funds.
Work falls under the common procurement vocabulary code for software support services and is categorised as defence services under the notice’s service classification.
The Microsoft Threat Analysis Centre, or MTAC, is described in the notice as detecting and disrupting nation-state cyber threats, digital espionage and automated influence operations. According to the notice, the centre sits within Microsoft Global Affairs and the company’s Corporate, External and Legal Affairs division, and analyses data across platforms to identify how digital tools and artificial intelligence are being used against democratic states.
MTAC has published a series of public reports since its establishment, assessing influence and cyber activity attributed to state-linked actors including Russia, Iran, China and North Korea. Its output has frequently focused on election-period interference, coordinated inauthentic behaviour on social platforms, and the growing role of generative AI in the production of manipulated media. The centre operates alongside Microsoft’s wider threat intelligence functions, which track intrusion activity against government and commercial networks worldwide.
The MOD has expanded its commercial relationships with major technology vendors in recent years as it builds out digital and cyber capability, with Defence Digital acting as the principal contracting authority for much of that activity. The department’s cyber and information warfare responsibilities are shared across several organisations, including the National Cyber Force, a joint MOD and GCHQ body headquartered at Samlesbury in Lancashire.
