azure-defender-for-iot

name	azure-defender-for-iot
description	Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying OT sensors/micro agents, mirroring OT traffic, handling alerts, or integrating Defender for IoT APIs, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel), Azure External Attack Surface Management (use azure-external-attack-surface-management).
compatibility	Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata	{"generated_at":"2026-08-09","generator":"docs2skills/1.0.0"}

Azure Defender For Iot Skill

This skill provides expert guidance for Azure Defender For Iot. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L47	Diagnosing and resolving Defender for IoT issues: CIS benchmark findings, micro agent problems, OT sensor install/health, and investigating alert types and responses.
Best Practices	L48-L53	Designing OT monitoring architectures and preparing industrial sites, including sensor placement, network topology, and deployment planning for Defender for IoT.
Decision Making	L54-L67	Guidance for planning and choosing Defender for IoT deployment options: OT traffic mirroring methods, appliance selection, licensing/billing, micro agent and console retirement, and version/support tracking.
Architecture & Design Patterns	L68-L74	OT network architectures for connecting sensors to Azure, sample connectivity models, and mapping Defender for IoT components to Purdue OT network layers.
Limits & Quotas	L75-L84	Data residency, retention limits, networking/port requirements, supported OT sensor/virtual appliance versions, and hardware/software specs for Defender for IoT deployments.
Security	L85-L104	Security alerts, recommendations, roles, RBAC, SSO, certificates, and sensor auth for securing Defender for IoT hubs, OT sensors, and monitoring OT networks with Zero Trust.
Configuration	L105-L133	Configuring Defender for IoT micro agents and OT sensors: installation, dependencies, behavior, monitoring methods, alerts, networking, integrations, and sensor management/maintenance.
Integrations & Coding Patterns	L134-L165	Integrating Defender for IoT with APIs, SIEM/SOAR, firewalls, OT tools, and configuring traffic mirroring and scripts for alert, inventory, and vulnerability data handling.
Deployment	L166-L191	Guides for deploying, upgrading, and configuring Defender for IoT OT sensors and micro agents, including hardware/VM appliance setups, traffic mirroring, regional moves, and hybrid/air-gapped installs.

Troubleshooting

Topic	URL
Investigate Defender IoT CIS benchmark recommendations	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark
Troubleshoot Defender for IoT micro agent issues	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent
Reference Microsoft Defender for IoT alert types	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/alert-engine-messages
Investigate and respond to Defender for IoT alerts	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/alerts
Troubleshoot Microsoft Defender for IoT OT sensors	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor
Validate Defender for IoT OT sensor software installation	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software
Interpret Defender for IoT sensor health messages	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/sensor-health-messages

Best Practices

Topic	URL
Plan OT monitoring architecture with Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring
Prepare OT sites and sensor placement for Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy

Decision Making

Topic	URL
Review Defender IoT micro agent feature support and retirement	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation
Choose OT traffic mirroring methods for Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods
Decide between SPAN, RSPAN, ERSPAN for OT mirroring	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods
Plan Defender for IoT billing and site licensing	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/billing
Choose and manage Defender for IoT licenses	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention
Determine Defender for IoT EIoT licensing needs	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-subscriptions-enterprise
Select appropriate OT appliances for Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing
Plan for Defender for IoT on-premises console retirement	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/on-premises-management-console-retirement
Plan transition from on-premises to cloud Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud

Architecture & Design Patterns

Topic	URL
Select architectures to connect OT sensors to Azure	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture-connections
Use sample OT network connectivity models for sensors	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models
Map Defender for IoT to Purdue OT network layers	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture

Limits & Quotas

Topic	URL
Understand Defender for IoT data residency mapping	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-data-processing
Networking requirements and ports for Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/networking-requirements
Review catalog of preconfigured OT monitoring appliances	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances
Check system requirements for virtual OT appliances	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances
Understand Defender for IoT data retention limits	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-data-retention
Review archived Defender for IoT OT sensor versions	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes-ot-monitoring-sensor-archive

Security

Topic	URL
Use Defender micro agent built-in security alerts	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts
Define custom Defender for IoT Hub alerts	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts
Apply Defender for IoT Hub security recommendations	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-recommendations
Use Defender for IoT Hub built-in alerts	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-security-alerts
Use ThreadX micro agent alerts and recommendations	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations
Call Defender for IoT sensor authentication APIs	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis
Meet SSL/TLS certificate requirements for OT sensors	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements
Manage Defender for IoT users and roles	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-overview
Configure Azure user permissions for Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-portal
Configure and manage OT sensor user access	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-sensor

Configuration

Topic	URL
Configure Defender for IoT micro agent behavior	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration
Review Linux OS dependencies for Defender micro agent	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies
Configure PAM to audit device sign-in events	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events
Configure DMI decoder for Defender micro agent	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder
Configure Defender IoT micro agent twin properties	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin
Install and authenticate Defender IoT micro agent on Edge	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-install-micro-agent-for-edge
Configure Defender IoT micro agent for Eclipse ThreadX	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module
Create and assign custom Defender IoT alerts	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts
Back up and restore Defender for IoT OT sensors	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/back-up-restore-sensor
Use Defender for IoT OT sensor CLI commands

Integrations & Coding Patterns

Topic	URL
Use Defender micro agent API for Eclipse ThreadX	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api
Manage OT sensor alerts using Defender for IoT APIs	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis
Manage OT sensor inventory via Defender for IoT APIs	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis
Access OT vulnerability data via Defender for IoT APIs	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis
Automate OT sensor disconnection alerts with Sentinel playbooks	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts
Enrich OT sensor data using Windows endpoint script	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script
Choose and configure Defender for IoT partner integrations	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrate-overview
Integrate ArcSight with Defender for IoT alert forwarding	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/arcsight
Send Defender for IoT alerts to LogRhythm SIEM	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/logrhythm
Integrate RSA NetWitness with Defender for IoT alerts	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/netwitness

Deployment

Topic	URL
Provision Defender IoT micro agent via DPS	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent
Move Defender IoT iotSecuritySolutions resource across regions	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-region-move
Upgrade Defender for IoT micro agent on Linux devices	https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/upgrade-micro-agent
Select and use OT monitoring appliances for Defender for IoT	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/
Deploy Dell PowerEdge R350 for OT sensor monitoring	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800
Deploy Dell PowerEdge R360 for OT sensor monitoring	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800
Deploy Dell PowerEdge R660 for OT sensor monitoring	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660
Deploy Heptagon YB3x appliance for OT monitoring	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x
Use HPE ProLiant DL20 Gen 11 (4SFF) for OT monitoring	https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11
Use HPE ProLiant DL20 Gen 11 (2LFF) for OT monitoring