Enable Microsoft Defender for IoT Hub

Risk Level: Medium (should be achieved)

Ensure that Microsoft Defender for IoT is enabled for your Microsoft Azure IoT Hub resources so that it can act as a central security hub for the IoT devices connected to your organization's network. Microsoft Defender for IoT integrates directly with the standard tier of Azure IoT Hub and, once enabled, continuously monitors device identity management, device-to-cloud, and cloud-to-device communication patterns to generate security recommendations and real-time alerts, without requiring an additional agent to be installed on the connected devices. For all newly created standard tier IoT hubs, Microsoft Defender for IoT is set to On by default, but it must be manually onboarded for existing IoT hubs that were created before this feature was enabled or that had it turned off during setup.

Security

IoT devices are frequently deployed with default credentials, rarely receive security patches, and often cannot run traditional endpoint security agents, making them a common entry point that attackers use to gain a foothold and move laterally within an enterprise network. By routing device identity management and communication patterns through Microsoft Defender for IoT, your security team can detect anomalous behavior, such as unauthorized devices, unusual communication endpoints, permissive firewall rules, or shared authentication credentials, early enough to contain a breach before it spreads to other parts of your Azure environment.

Enabling Microsoft Defender for IoT incurs additional charges that are calculated based on your usage level, such as the volume of monthly messages processed from your IoT hubs. Organizations should review the current pricing details before onboarding production IoT hubs. Microsoft Defender for IoT also supports hybrid and local (on-premises) deployment models that run on your own physical infrastructure; these deployment types require additional setup that is outside the scope of this Azure IoT Hub-level recommendation.

Audit

To determine if Microsoft Defender for IoT is enabled for your Azure IoT hubs, perform the following operations:

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to IoT Hub console available at https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Devices%2FIotHubs to list the IoT hubs available within your Azure account.
Click on the name (link) of the IoT hub that you want to examine.
In the left navigation panel, under Defender for IoT, choose Overview.
Check whether the Threat prevention and Threat detection panels are displayed on the Overview page:
- If a Secure your IoT solution button is displayed instead, Microsoft Defender for IoT is not enabled for the selected IoT hub.
- If the Threat prevention and Threat detection panels are displayed, Microsoft Defender for IoT is enabled for the selected IoT hub.
Repeat steps no. 3 – 5 for each IoT hub available within the selected Azure subscription.
Repeat steps no. 2 – 6 for each Azure subscription available within your Microsoft Azure account.

Using Azure CLI

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
```
az account list
--query '[*].id'
```

The command output should return the requested subscription identifiers (IDs):

[
    "abcdabcd-1234-abcd-1234-abcdabcdabcd",
    "abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
```
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```
Run iot hub list command (Windows/macOS/Linux) with output query filters to list the resource IDs of the IoT hubs available in the selected Azure subscription:
```
az iot hub list
--query '[*].id'
```

The command output should return the requested IoT Hub resource IDs:

[
    "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Devices/IotHubs/cc-main-iot-hub"
]

Run resource list command (Windows/macOS/Linux) with output query filters to list the resource IDs of the Microsoft Defender for IoT security solutions configured in the selected Azure subscription:
```
az resource list
--resource-type "Microsoft.Security/iotSecuritySolutions"
--query '[*].id'
```

The command output should return the requested Defender for IoT security solution resource IDs:

[
    "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Security/iotSecuritySolutions/cc-iot-defender-solution"
]

Run resource show command (Windows/macOS/Linux) with the ID of the Defender for IoT security solution identified at step no. 7, using custom query filters to describe its enablement status and the IoT hubs it covers:

az resource show
--ids /subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Security/iotSecuritySolutions/cc-iot-defender-solution
--query '{status:properties.status, iotHubs:properties.iotHubs}'

The command output should return the solution's enablement status and covered IoT hubs:
```
{
  "status": "Enabled",
  "iotHubs": [
    "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Devices/IotHubs/cc-main-iot-hub"
  ]
}
```
If the resource ID of the IoT hub identified at step no. 5 is not listed in the iotHubs property returned by any Microsoft Defender for IoT security solution, or if the status property value is set to Disabled, Microsoft Defender for IoT is not enabled for the selected IoT hub.
Repeat step no. 8 to verify the enablement status for other IoT hubs available in the selected Azure subscription.
Repeat steps no. 3 – 10 for each Azure subscription available within your Microsoft Azure account.

Remediation / Resolution

To enable Microsoft Defender for IoT for your existing Azure IoT hubs, perform the following operations:

Microsoft Defender for IoT currently only supports IoT hubs deployed with the standard pricing tier. Enabling Microsoft Defender for IoT incurs additional usage-based charges, as described in the Impact section.

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to IoT Hub console available at https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Devices%2FIotHubs.
Click on the name (link) of the IoT hub that you want to reconfigure (see Audit section to identify the right resource).
In the left navigation panel, under Defender for IoT, choose Overview.
Choose Secure your IoT solution, and complete the onboarding form, including selecting a Log Analytics workspace to connect to, to enable Microsoft Defender for IoT for the selected IoT hub.
Repeat steps no. 3 – 5 for each non-compliant IoT hub available in the selected Azure subscription.
Repeat steps no. 2 – 6 for each Azure subscription available within your Microsoft Azure account.

Using Azure CLI

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that contains the non-compliant IoT hub identified in the Audit section, to set it as the current active subscription (the command does not produce an output):
```
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```

Run resource create command (Windows/macOS/Linux) to create a Microsoft Defender for IoT security solution that covers the non-compliant IoT hub identified in the Audit section, connecting it to a Log Analytics workspace for alert and event storage:

az resource create
--resource-type "Microsoft.Security/iotSecuritySolutions"
--name cc-iot-defender-solution
--resource-group cc-iot-resource-group
--location eastus
--properties '{
  "displayName": "cc-iot-defender-solution",
  "status": "Enabled",
  "iotHubs": [
    "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Devices/IotHubs/cc-main-iot-hub"
  ],
  "workspace": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.OperationalInsights/workspaces/cc-iot-workspace"
}'

The command output should return the newly created security solution, with the status property set to Enabled:

{
  "id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Security/iotSecuritySolutions/cc-iot-defender-solution",
  "name": "cc-iot-defender-solution",
  "type": "Microsoft.Security/iotSecuritySolutions",
  "properties": {
    "displayName": "cc-iot-defender-solution",
    "status": "Enabled",
    "iotHubs": [
      "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Devices/IotHubs/cc-main-iot-hub"
    ],
    "workspace": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.OperationalInsights/workspaces/cc-iot-workspace"
  }
}

If a Microsoft Defender for IoT security solution already exists for the selected Azure subscription, run resource update command (Windows/macOS/Linux) to add the non-compliant IoT hub's resource ID to the existing solution's iotHubs property instead of creating a new solution:

az resource update
--ids /subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Security/iotSecuritySolutions/cc-iot-defender-solution
--set properties.iotHubs='["/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Devices/IotHubs/cc-main-iot-hub", "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cc-iot-resource-group/providers/Microsoft.Devices/IotHubs/cc-second-iot-hub"]'

Repeat steps no. 2 – 4 for each non-compliant IoT hub available in the selected Azure subscription.
Repeat steps no. 1 – 5 for each Azure subscription available within your Microsoft Azure account.

By default, Microsoft Defender for IoT is set to On for all newly created standard tier IoT hubs. It is not available for basic (free) tier IoT hubs and must be manually onboarded for existing IoT hubs.

References

Azure Command Line Interface (CLI) Documentation
az account
az account
az iot hub
az resource
az resource
az resource
az resource

Publication date Sep 22, 2026

Audit

Using Azure Console

Using Azure CLI

Remediation / Resolution

Using Azure Console

Using Azure CLI

References

Related SecurityCenter rules