1---2name: azure-defender-for-iot3description: Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying OT sensors, configuring micro agents, mirroring OT traffic, integrating with SIEM/Sentinel, or managing alerts, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure External Attack Surface Management (use azure-external-attack-surface-management), Azure IoT (use azure-iot).4---5# Azure Defender For Iot Skill67This skill provides expert guidance for Azure Defender For Iot. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.89## How to Use This Skill1011> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file1213This skill requires **network access** to fetch documentation content:14- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch`. Returns Markdown.15- **Fallback**: Use `WebFetch`. Returns Markdown.1617## Category Index1819| Category | Lines | Description |20|----------|-------|-------------|21| Troubleshooting | L33-L41 | Diagnosing and fixing Defender for IoT micro agent and OT sensor issues, validating sensor installs, interpreting sensor health messages, and understanding built-in alert types. |22| Best Practices | L42-L49 | Best practices for OT/ICS: using CIS benchmarks, designing monitoring topology, planning sensor placement at sites, and optimizing alert triage and response workflows. |23| Decision Making | L50-L61 | Guidance on choosing OT traffic mirroring methods, licenses, and appliances, plus planning billing, console retirement, cloud transition, and tracking Defender for IoT OT software versions. |24| Architecture & Design Patterns | L62-L68 | OT network architectures for connecting sensors to Azure, sample connectivity models, and mapping Defender for IoT components to Purdue OT network layers. |25| Limits & Quotas | L69-L79 | Data residency, retention limits, feature lifecycle, supported/archived OT sensors, virtual appliance requirements, and networking/port prerequisites for Defender for IoT. |26| Security | L80-L102 | Security alerts, recommendations, roles, auth, and certificates for Defender for IoT/IoT Hub/OT sensors, including RBAC, SSO, PAM auditing, and Zero Trust monitoring. |27| Configuration | L103-L126 | Configuring Defender for IoT micro agents and OT sensors: setup, OS dependencies, monitoring modes, networking/proxy/DNS/firewall, sensor management, maintenance, and auditing activity. |28| Integrations & Coding Patterns | L127-L161 | Integrating Defender for IoT with SIEMs, firewalls, ServiceNow, Sentinel, and partner tools, plus APIs, micro agent provisioning, traffic mirroring, and automation patterns. |29| Deployment | L162-L184 | Hardware/VM requirements and step-by-step guides to deploy, configure, mirror traffic, back up, restore, and update Defender for IoT OT sensor appliances and VMs. |3031### Troubleshooting32| Topic | URL |33|-------|-----|34| Troubleshoot Defender for IoT micro agent issues | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent |35| Reference Microsoft Defender for IoT alert types | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/alert-engine-messages |36| Troubleshoot Microsoft Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor |37| Validate Defender for IoT OT sensor software installation | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software |38| Interpret Defender for IoT sensor health messages | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/sensor-health-messages |3940### Best Practices41| Topic | URL |42|-------|-----|43| Investigate CIS benchmark recommendations in Defender | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark |44| Plan OT monitoring topology with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring |45| Prepare OT sites and sensor placement for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy |46| Optimize OT alert workflows on Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-accelerate-alert-incident-response |4748### Decision Making49| Topic | URL |50|-------|-----|51| Choose OT traffic mirroring methods for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods |52| Decide between SPAN, RSPAN, ERSPAN for OT mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods |53| Plan Defender for IoT billing and licensing | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/billing |54| Choose and extend Defender for IoT licenses | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention |55| Select appropriate OT appliances for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing |56| Plan for Defender for IoT on-premises console retirement | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/on-premises-management-console-retirement |57| Transition Defender for IoT management from on-premises to cloud | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud |58| Track Defender for IoT OT software versions and support | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes |5960### Architecture & Design Patterns61| Topic | URL |62|-------|-----|63| Select architectures to connect OT sensors to Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture-connections |64| Use sample OT network connectivity models for sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models |65| Map Defender for IoT to Purdue OT network layers | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture |6667### Limits & Quotas68| Topic | URL |69|-------|-----|70| Understand Defender for IoT data residency mapping | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-data-processing |71| Review Defender for IoT feature support lifecycle | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation |72| Networking requirements and ports for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/networking-requirements |73| Review catalog of preconfigured OT monitoring appliances | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances |74| Check system requirements for virtual OT appliances | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances |75| Understand Defender for IoT data retention limits | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-data-retention |76| Review archived Defender for IoT OT sensor versions | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes-ot-monitoring-sensor-archive |7778### Security79| Topic | URL |80|-------|-----|81| Use Defender micro agent built-in security alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts |82| Define custom Defender for IoT Hub alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts |83| Apply Defender for IoT Hub security recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-recommendations |84| Use Defender for IoT Hub built-in alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-security-alerts |85| Use ThreadX micro agent alerts and recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations |86| Configure PAM auditing for Defender sign-in events | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events |87| Create and assign custom Defender device alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts |88| Call Defender for IoT sensor authentication APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis |89| Meet SSL/TLS certificate requirements for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements |90| Enable enterprise IoT security in Defender for Endpoint | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/eiot-defender-for-endpoint |91| Manage Defender for IoT users and roles | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-overview |92| Assign Azure RBAC roles for Defender for IoT access | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-portal |93| Manage on-premises users on Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-sensor |94| Apply Zero Trust monitoring to OT networks with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/monitor-zero-trust |95| Create CA-signed SSL/TLS certificates for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates |96| Use Defender for IoT security recommendations to reduce OT risk | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/recommendations |97| Map Azure RBAC roles to Defender for IoT actions | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-azure |98| Configure on-premises Defender for IoT user roles | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-on-premises |99| Configure SSO with Entra ID for IoT sensor console | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/set-up-sso |100101### Configuration102| Topic | URL |103|-------|-----|104| Configure Defender for IoT micro agent behavior | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration |105| Review Linux OS dependencies for Defender micro agent | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies |106| Configure DMI decoder for Defender micro agent | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder |107| Configure Defender for IoT micro agent twin | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin |108| Configure Defender micro agent for Eclipse ThreadX | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module |109| Use Defender for IoT OT sensor CLI commands | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/cli-ot-sensor |110| Configure OT active monitoring methods in Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-active-monitoring |111| Configure reverse DNS lookup for OT device enrichment | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup |112| Configure OT sensor settings centrally from Azure portal | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal |113| Set up Windows Endpoint Monitoring for OT networks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring |114| Configure OT sensor proxy connections to Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/connect-sensors |115| Import supplemental OT device data into sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-import-device-information |116| Perform OT sensor maintenance via sensor console GUI | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors |117| Manage Defender for IoT sensors in Azure portal | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-sensors-on-the-cloud |118| Set up SNMP MIB health monitoring for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring |119| Manage threat intelligence package updates on OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages |120| Onboard OT sensors to Defender for IoT in Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/onboard-sensors |121| Configure and activate Microsoft Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor |122| Configure firewall endpoints for OT sensor cloud management | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management |123| Audit and track Defender for IoT user activity | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/track-user-activity |124125### Integrations & Coding Patterns126| Topic | URL |127|-------|-----|128| Provision Defender micro agent with DPS and X.509 | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent |129| Use Defender micro agent API for Eclipse ThreadX | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api |130| Manage OT sensor alerts using Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis |131| Manage OT sensor inventory via Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis |132| Access OT vulnerability data via Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis |133| Automate OT sensor disconnection alerts with Sentinel playbooks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts |134| Enrich Windows endpoint data using local script | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script |135| Forward OT sensor alerts to partner systems and syslog | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners |136| Choose and configure Defender for IoT partner integrations | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrate-overview |137| Integrate ArcSight with Defender for IoT alert forwarding | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/arcsight |138| Send Defender for IoT alerts to LogRhythm SIEM | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/logrhythm |139| Integrate RSA NetWitness with Defender for IoT alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/netwitness |140| Connect on-premises Defender for IoT sensors to Sentinel (legacy) | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel |141| Stream Defender for IoT cloud alerts to third-party SIEMs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners |142| Configure legacy ServiceNow integration for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy |143| Use Sentinel solution to investigate Defender for IoT threats | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring |144| Connect Defender for IoT with Microsoft Sentinel via data connector | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-solution |145| Integrate with Microsoft Defender for IoT REST APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis |146| Configure Cisco ERSPAN for Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan |147| Use ESXi vSwitch promiscuous mode for OT traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi |148| Use Hyper-V vSwitch promiscuous mode for OT mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v |149| Configure Cisco RSPAN mirroring for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan |150| Configure Cisco SPAN ports for Defender for IoT traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span |151| Integrate CyberArk with Defender for IoT for credential security | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-cyberark |152| Integrate Forescout with Defender for IoT for OT visibility | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-forescout |153| Integrate Fortinet firewalls with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-fortinet |154| Integrate Palo Alto firewalls with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto |155| Integrate IBM QRadar with Defender for IoT alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-qradar |156| Integrate ServiceNow OT Manager with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-servicenow |157| Integrate Splunk with Microsoft Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-splunk |158| Visualize Defender for IoT data with Azure Monitor workbooks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/workbooks |159160### Deployment161| Topic | URL |162|-------|-----|163| Select and use OT monitoring appliances for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ |164| Deploy Dell PowerEdge R350 for OT sensor monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800 |165| Deploy Dell PowerEdge R360 for OT sensor monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800 |166| Deploy Dell PowerEdge R660 for OT sensor monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660 |167| Deploy Heptagon YB3x appliance for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x |168| Use HPE ProLiant DL20 Gen 11 (4SFF) for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11 |169| Use HPE ProLiant DL20 Gen 11 (2LFF) for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff |170| Use legacy HPE ProLiant DL20 for enterprise OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy |171| Use HPE ProLiant DL20 Gen10 Plus for enterprise OT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise |172| Use HPE ProLiant DL20 Gen10 Plus (2LFF) for SMB OT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb |173| Deploy Defender for IoT on HPE ProLiant DL360 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360 |174| Deploy Defender for IoT on HPE ProLiant DL360 Gen 11 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11 |175| Deploy Defender for IoT OT sensor VM on Hyper-V Gen 2 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v |176| Deploy Defender for IoT OT sensor VM on VMware ESXi | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware |177| Deploy YS-techsystems YS-FIT2 for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2 |178| Back up and restore Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/back-up-restore-sensor |179| Plan hybrid or air-gapped Defender for IoT deployments | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy |180| Install and initially configure Defender for IoT OT sensor software | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor |181| Deploy OT sensors with correct traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring |182| Update Defender for IoT OT sensor software versions | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/update-ot-software |
atc-net