Daily Defender News
Track documentation and Message Center changes for Microsoft Defender for IoT.
Microsoft Learn documentation ↗The page now highlights required Azure portal permissions or OT sensor access, clarifies migration guidance for alert exclusion rules, and warns that deleting custom alert rules is irreversible. Links and wording were also updated.
The article now uses the heading “Compare OT device programming files,” includes a named anchor, simplifies wording, updates metadata, and presents the device-information import link as a next-step callout.
The article now separates prerequisites and states that users must be default privileged admins or have the Admin role on the sensor. Setup wording for Azure portal and OT network sensors was also streamlined.
The documentation now specifies that SMB credentials authenticate with the shared backup folder and updates the description of GUI-based sensor maintenance tasks. Page metadata was also updated.
Updated the article title, date, metadata, formatting, and terminology for configuration status and failure reporting.
The article updates its metadata and rewords the prerequisite requiring the sensor’s management-port IP address to reach the OT network before active monitoring is configured.
The page clarifies distribution-file selection, CMake and IAR build instructions, configuration-setting descriptions, network activity collection, Log Analytics guidance, and related-content links. The security alerts and API links are now marked as preview.
The documentation adds a warning that deleting a sensor setting permanently removes it and requires recreation. It also clarifies disconnected-sensor editing, ICS subnet behavior, and backup server setup and troubleshooting.
The guide updates metadata, wording, capitalization, and references to examples. It also renames “Next steps” to “Related content” and adjusts the Micro agent event collection link presentation.
The proxy configuration guidance now requires outbound HTTPS traffic on port 443 from the sensor to Defender for IoT endpoints. Section links and documentation metadata were also updated.
Updated the page metadata, clarified the OT sensor activation prerequisite link text, and renamed the final section from “Next steps” to “Related content.”
The article now provides an overview of roles and permissions, clarifies Microsoft Entra global roles versus Defender unified RBAC, adds prerequisite guidance, and improves links to feature-specific permission mappings and site security monitoring.
The article now explicitly describes active probing, required OT sensor and active monitoring prerequisites, WMI namespace permissions, and related content. Links and metadata were also updated.
The page title capitalization, publication date, custom metadata, and the “For more information, see” section heading were updated.
The article now uses clearer terminology and navigation for the OT sensor deployment path, subnet configuration, ICS subnet definition, port and VLAN naming, DNS lookup, and DHCP procedures. Metadata and section formatting were also updated.
The article now presents its user-management procedures more clearly, including prerequisites as notes, revised wording and links, and updated metadata.
The article now clearly covers creating, editing, and removing sensor users, Active Directory integration, and privileged-access recovery. Prerequisites are presented as notes, and headings, links, metadata, and related-content formatting were updated.
The page metadata was refreshed, wording was updated to refer to potential attack paths, and the “Next steps” section was renamed “Related content” while retaining the same links.
The guide updates capitalization, phrasing, drop-down terminology, the Save button label, and changes the “Next steps” heading to “Related content.”
The article title now specifies OT sensors, and the instructions clarify how to create and update custom data mining reports. Metadata and the final section heading were also updated.
The page now specifies that an OT sensor displays reports for OT sensors connected to the same management console. It also updates the title, formatting, metadata, and related-content links.
The page now clarifies the role-requirements link, renames “Next steps” to “Related content,” and revises wording for cloud-connected sensor reports. The same related report links remain available, with metadata also updated.
The documentation now describes Vendor as the device’s hardware vendor, as identified from the MAC address.
The article now covers finding OT devices, filtering inventory data, investigating device details, managing site associations, and accessing vulnerability-prioritization guidance. Metadata was also updated.
The recommendations page was revised with updated wording, filtering and navigation instructions, terminology, metadata, and section headings.
Updated metadata, corrected possessive grammar, and reformatted the related links section as a bulleted list.
The article now refers to Microsoft 365 E5 or E5 Security plans, clarifies that disabling enterprise IoT security removes access to alerts, vulnerabilities, and recommendations, and updates the standalone-license link text.
The article now highlights prerequisites, explicitly lists Email, Syslog server, and NetWitness action types, and adds a certificate-validation troubleshooting subsection. Metadata and heading formatting were also updated.
The page’s `ms.custom` metadata changed from `msecd-doc-authoring-1013` to `msecd-doc-authoring-1016`.
The page now tells administrators to assign obtained licenses to specific users before using them. It also clarifies that the device count refers to identified unique devices; metadata was updated.
The article now provides clearer descriptions of SMBIOS requirements, renamed configuration sections, stable anchors, corrected module twin JSON formatting, and reorganized related links.
The article now clarifies the OT sensor prerequisite, adds the need for a CSV-capable editor, restructures the import steps, updates terminology, and specifies that devices omitted from an authorized-devices import are marked not authorized and can generate new traffic alerts.
The article now has clearer installation wording, reordered repository setup commands, and updated guidance that the baseline validation failure recommendation may take up to one hour to appear in IoT Hub.
The article’s publication date changed from June 12 to July 3, 2026, and its custom authoring metadata was updated. The supplied content excerpt is unchanged.
The article now highlights prerequisites, including an activated sensor and required permissions, and warns that deleting a device permanently removes it from inventory. It also refreshes wording and navigation labels throughout the device map and notification guidance.
The page refreshes metadata and clarifies how to investigate Defender for IoT incidents, use the DeviceInfo Site property in advanced hunting, and interpret the San Francisco site query.
The page now clarifies prerequisites, certificate-validation wording, interface update behavior, analytics-engine guidance, and related links. An alert callout was also added.
The article now explains Automatic and Manual update modes, provides a direct onboarding link, clarifies portal navigation and package status details, and links the Sites and sensors page.
The page title, heading, role-and-permissions link text, metadata, and formatting were updated.
The page adds guidance for calculating detected devices for standalone licensing and warns that disabling Enterprise IoT security stops all purpose-built alerts, vulnerabilities, and recommendations. It also clarifies cancellation steps for legacy plan customers.
The article was refreshed with clearer wording, updated terminology and capitalization, improved formatting of UI labels, and revised instructions for filtering, exporting, and identifying devices that have not recently communicated.
The article now describes sizing, purchasing, and updating licenses, including moving from a trial to a permanent license. Section headings, links, metadata, and the fallback from Purchase services to Marketplace were clarified.
The migration guidance now explicitly instructs administrators to select Microsoft 365 as the price plan, save the change, and then update site details to match the license. Wording, metadata, and related-content labeling were also updated.
The guidance now warns that deleting a sensor removes its registration, disconnects it from the Azure portal, cannot be undone, and requires re-onboarding with new settings.
The article title, metadata, and introductory wording were updated. The site assignment instructions now clarify that a manual site assignment remains until the device is reset, while automatic reassignment is prevented.
The page received refreshed metadata, formatting, wording, section headings, an updated alerts reference link, and a renamed “Related content” section.
The article now describes viewing, filtering, editing, exporting, merging duplicate devices, and deleting inactive devices. It also clarifies that deletion applies to devices matching the current Last Activity filter and updates export time-zone guidance.
The article now includes an overview of viewing, investigating, and managing alerts across supported locations, with clearer terminology, navigation links, synchronization wording, and remediation references.
The page now uses clearer terminology for the legacy and replacement micro agents, presents tutorial links as a list, and renames the final section to “Related content.” Support and retirement wording remains included.
The page title now identifies Microsoft Defender for IoT in the Defender portal, and the guidance says to select a device count in the site list to view accessible device data.
The article now consistently uses the iotSecuritySolutions resource name, updates metadata and wording, and streamlines the Azure portal, Log Analytics, verification, and cleanup instructions.
The guide changes the “Next steps” heading to “Next step” and removes the sentence beneath it.
The article’s metadata, vulnerability-discovery link text, and filtering instructions were revised for clarity.
The article’s title, metadata, role-prerequisite wording, connectivity-team responsibilities, direct-connection context, and endpoint-download heading were revised.
The article now specifies that the module twin and device module should use the same X.509 or CA certificate used for DPS enrollment. It also updates headings, links, metadata, and navigation structure.
The documentation standardizes table separators, uses a dash for the empty vendor description cell, and updates the details field guidance and link.
Updated the article’s wording for Azure portal alerts, source and destination devices, remediation steps, and learning or unlearning alert traffic. The free-account link and document metadata were also refreshed.
The page metadata, wording, heading, anchor, and OT Security prerequisite guidance were updated. The review section is now titled “Review OT and Enterprise IoT security initiatives in the Defender portal.”
The Defender for IoT RBAC setup article now directs readers to review prerequisites before configuring roles and permissions. Its metadata was also updated.
The Defender for IoT SSO article now identifies Microsoft Graph User.Read as the required permission and states that an administrator must grant tenant-wide consent. Wording, headings, metadata, and related-content formatting were also updated.
The article now links to prerequisites and recommends having the IP or MAC address of at least one OT device discovered by Microsoft Defender for Endpoint before associating devices with a site. Minor wording and metadata were also updated.
The guide now instructs administrators to access the Defender for IoT CLI over SSH as the cyberx user before setup. It also expands encryption names and updates related guidance.
The documentation now expands L2 as Layer 2, clarifies the Wireshark validation wording, and updates the link text for validating traffic mirroring.
The article received updated metadata, wording, and clearer procedure structure for filtering, viewing, exporting, and manually adding timeline events.
The page title capitalization was revised, and the “Next steps” heading was changed to “Next step.”
The page title changed from “Troubleshoot the sensor” to “Troubleshoot the Sensor,” and the “Next steps” heading was renamed “Related content.”
The tutorial replaces the “Next steps” section and ServiceNow Store access line with “Related content” and a “Next step” heading.
The tutorial removes bold formatting from the Splunk access instruction and changes “Next steps” to “Next step.”
The page title capitalization was updated, and the Standalone micro agent and Micro agent for Edge labels were reformatted as section headings. A resource-introduction line was removed.
The page received updated metadata and wording, a new sentence introducing the device-inventory viewing steps, and clearer headings and text for editing individual device properties.
The article adds clearer navigation for viewing alerts, a considerations section, refreshed grouping-option formatting, and minor wording, punctuation, metadata, and title updates.
The page title and metadata were updated, and alert-viewing, management, and export instructions were reformatted with clearer step numbering and wording.
The page title capitalization was updated, workbook topics were changed to headings, and the “Next steps” section was renamed “Related content” with updated resource references.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/billing.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-configure-micro-agent-twin.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-threadx-security-module.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/configure-pam-to-audit-sign-in-events.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/configure-sensor-settings-portal.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/manage-users-sensor.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/quickstart-create-custom-alerts.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/device-inventory.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/eiot-defender-for-endpoint.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/recommendations.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/concept-enterprise.md.
Updated Microsoft Defender documentation in defender-for-iot/get-started.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/getting-started.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-install-micro-agent-for-edge.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/tutorial-servicenow.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/tutorial-splunk.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-investigate-cis-benchmark.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-manage-device-inventory-on-the-cloud.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/how-to-manage-sensors-on-the-cloud.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/how-to-manage-subscriptions.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/manage-subscriptions-enterprise.md.
Updated Microsoft Defender documentation in defender-for-iot/manage-license.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/edge-security-module-deprecation.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/license-and-trial-license-extention.md.
Updated Microsoft Defender documentation in defender-for-iot/microsoft-defender-iot.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-region-move.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/ot-deploy/ot-deploy-path.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/overview.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/best-practices/plan-corporate-monitoring.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/ot-deploy/provision-cloud-management.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/device-builders/how-to-provision-micro-agent.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/references-data-retention.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/release-notes.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/set-up-sso.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/traffic-mirroring/set-up-traffic-mirroring.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/ot-deploy/transition-on-premises-management-console-to-cloud.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/tutorial-onboarding.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/ot-deploy/update-device-inventory.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/workbooks.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/whats-new.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/whats-new-archive.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/how-to-accelerate-alert-incident-response.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/how-to-analyze-programming-details-changes.md.
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/back-up-restore-sensor.md.
