diff --git a/packages/m365_defender/changelog.yml b/packages/m365_defender/changelog.yml
index d95e64dda96..33f4611c978 100644
--- a/packages/m365_defender/changelog.yml
+++ b/packages/m365_defender/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.17.1"
+  changes:
+    - description: Change connection_string to be a secret
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/12112
 - version: "2.17.0"
   changes:
     - description: Do not remove `event.original` in main ingest pipeline.
diff --git a/packages/m365_defender/data_stream/event/manifest.yml b/packages/m365_defender/data_stream/event/manifest.yml
index 03f55dc777a..5f6dda45aa2 100644
--- a/packages/m365_defender/data_stream/event/manifest.yml
+++ b/packages/m365_defender/data_stream/event/manifest.yml
@@ -24,11 +24,12 @@ streams:
         description: >-
           We recommend using a dedicated consumer group for the azure input. Reusing consumer groups among non-related consumers can cause unexpected behavior and possibly lost events.
       - name: connection_string
-        type: text
+        type: password
         title: Connection String
         multi: false
         required: true
         show_user: true
+        secret: true
         description: >-
           The connection string required to communicate with Event Hubs. See [Get an Event Hubs connection string](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string) to learn more.
       - name: storage_account
diff --git a/packages/m365_defender/manifest.yml b/packages/m365_defender/manifest.yml
index e1d37f9f073..6c4c97ade2c 100644
--- a/packages/m365_defender/manifest.yml
+++ b/packages/m365_defender/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: m365_defender
 title: Microsoft M365 Defender
-version: "2.17.0"
+version: "2.17.1"
 description: Collect logs from Microsoft M365 Defender with Elastic Agent.
 categories:
   - "security"