Microsoft Azure Defender for IoT Training

Published Jun 09 2021 01:45 PM 12.1K Views


The following courses will guide you to becoming an Azure Defender for IoT Ninja. 



This training program includes over 28 videos divided into 5 modules. For each session, the post includes a video, and/or a presentation, along with supporting information when relevant: product documentation, blog posts, and additional resources. 
The modules are organized into the following groups: 

  • Overview 
  • Basic Features 
  • Deployment 
  • Sentinel Integration 
  • Advanced  

Check back often as additional items will be published regularly.



Azure Defender for IoT enables IT and OT teams to auto-discover their unmanaged IoT/OT assets, identify critical vulnerabilities, and detect anomalous or unauthorized behavior — without impacting IoT/OT stability or performance. 

Azure Defender for IoT delivers insights within minutes of being connected to the network, leveraging patented IoT/OT-aware behavioral analytics and machine learning to eliminate the need to configure any rules, signatures, or other static IOCs. To capture the traffic, it uses an on-premises network sensor deployed as a virtual or physical appliance connected to a SPAN port or tap. The sensor implements non-invasive passive monitoring with Network Traffic Analysis (NTA) and Layer 7 Deep Packet Inspection (DPI) to extract detailed IoT/OT information in real-time.


This section provides background information on IoT and OT networks and an overview of the Microsoft Azure Defender for IoT platform.


Start Here 

kimwall_0-1623189683350.png 17m: How does Azure Defender for IoT secure OT (operational technology) environments? 
kimwall_1-1623189683351.png  How does Azure Defender for IoT secure OT (operational technology) environments? 
kimwall_2-1623189683351.png 12m: What is the Azure Defender for IoT Architecture? 
kimwall_3-1623189683352.png What is the Azure Defender for IoT Architecture? 

kimwall_2-1623189683351.png 4m: Azure Defender for IoT Reference Architecture


Learn More 

Blog: Go inside the new Azure Defender for IoT including CyberX 

kimwall_4-1623189683352.png 22m: Agentless IoT/OT security with Azure Defender for IoT 
kimwall_5-1623189683352.png 35m: Azure Defender for IoT Overview  
kimwall_6-1623189683352.png 25m: Azure Defender for IoT Introduction 
kimwall_7-1623189683353.png 38m: What is OT and how is it different from IT? 
kimwall_8-1623189683353.png 23m: How Azure Defender for IoT fills the security gap in OT networks 
kimwall_9-1623189683353.png 13m: Azure Defender for IoT overview and demo 
kimwall_10-1623189683354.png 13m: Azure Defender for IoT agentless monitoring demo 

Blog: Designing a Robust Defense for Operational Technology Using Azure Defender for IoT

Blog: Microsoft scores highest in threat visibility coverage for MITRE ATT&CK for ICS

Blog: How to gain more from your connection to an OT network




Basic Features 

Learn about the core features of the platform including asset discovery, deployment options, reporting, alert handling, event timeline, risk assessment, attack vector simulations, and data mining and baselining.  


Start Here 

kimwall_11-1623189683354.png 43m: Demonstration of Microsoft Azure Defender for IoT platform

kimwall_14-1623189683355.png Demonstration of Microsoft Azure Defender for IoT platform 
kimwall_12-1623189683354.png 10m: How to discover and classify assets within your industrial network using Defender for IoT 

kimwall_3-1625243773182.png Asset discovery solution brief

kimwall_13-1623189683354.png 6m: How to discover exploitable paths using attack vector simulation 
kimwall_14-1623189683355.png How to discover exploitable paths using attack vector simulation 
kimwall_15-1623189683355.png 8m: How to run reports and attack vector simulations 
kimwall_16-1623189683355.png How to run reports and attack vector simulations 
kimwall_17-1623189683356.png 5m: How to use the event timeline 
kimwall_18-1623189683356.png 11m: How to analyze the risk assessment report 

kimwall_4-1625243968009.png Sample Risk Assessment report

kimwall_0-1624901390578.png 9m: How to handle Microsoft Azure Defender for IoT Alerts

kimwall_16-1623189683355.png How to handle Microsoft Azure Defender for IoT Alerts

kimwall_0-1624901390578.png 5m: How data mining and baselining works in Microsoft Defender for IoT

kimwall_16-1623189683355.png How data mining and baselining works in Microsoft Defender for IoT


Learn More 

Doc: Working with the device inventory

Doc: Working with the Event Timeline

Doc: Risk Assessment Reporting

Doc: Understanding Sensor Alerts

Doc: Alert types and descriptions

Doc: Creating Data Mining Reports

kimwall_19-1623189683356.png 52m: Zero Trust Webinar with Azure Defender for IoT 
kimwall_20-1623189683356.png 24m: Analytics, data management and hunting with Azure Defender for IoT 
kimwall_21-1623189683357.png 24m: Deployment methodologies - hybrid cloud vs air-gapped environments 

Doc: Azure Defender for IoT Architecture in product documentation 

Blog: Cloud-delivered IoT/OT threat intelligence 

Blog: Azure Defender for IoT quick start instructions 




This section provides details on the deployment and tuning specifics. Learn about the differences between on-premises-only and cloud-connected options. Walk through the licensing components within the Azure portal.  


Start Here 

kimwall_22-1623189683357.png 35m: How to successfully deploy a sensor 

kimwall_16-1623189683355.png How to successfully deploy a sensor

kimwall_0-1624901390578.png 15m: How to optimize and tune the Microsoft Azure Defender for IoT platform

kimwall_16-1623189683355.png How to optimize and tune the Microsoft Azure Defender for IoT platform


Learn More 

Doc: Setting up your Defender for IoT network

Blog: Designing a Robust Defense for Operational Technology Using Azure Defender for IoT 

kimwall_23-1623189683357.png 33m: Deploying and configuring an offline sensor 



Sentinel Integration 

For cloud-connected options, remote sensors will send logging and analysis data to Azure. Once in the cloud, logging and asset data may be forwarded to Sentinel. All of the tools within Sentinel become available including automation/playbooks, workbooks, threat hunting and analytics, incident handling, notebooks, and more.  


Start Here 

kimwall_24-1623189683358.png 16m: How to protect OT networks from Triton using Azure Sentinel Playbooks 

kimwall_24-1623189683358.png 5m: How Microsoft Azure Defender for IoT uses the IoT Hub




Learn about advanced features and integrations including custom alerts, MITRE framework, enterprise data integration, large scale deployments, SOC integration, and more.  


Start Here 

kimwall_25-1623189683358.png 13m: How to use the enterprise data integrator 
kimwall_26-1623189683358.png How to use the enterprise data integrator 

kimwall_25-1623189683358.png 12m: How to create custom alerts in Defender for IoT

kimwall_25-1623189683358.png  53m: How Defender for IoT maps to MITRE ATT&CK

kimwall_26-1623189683358.png How Defender for IoT maps to MITRE ATT&CK

kimwall_25-1623189683358.png  5m: Integrating with Splunk and ServiceNow

kimwall_25-1623189683358.png 53m: Large scale deployment of Defender for IoT

kimwall_26-1623189683358.png  Large scale deployment of Defender for IoT


Learn More 

Blog: Looking for Anomalies in your IoT Asset Telemetry 

Doc: Creating Custom Alerts 

Doc: Integrating data into the enterprise device inventory

Blog: Azure Defender for IoT Raw-Data and ICS MITRE ATT&CK Matrix Mapping via Azure Sentinel





Azure Defender for IoT Product Documentation 

You may find product documentation in the Azure portal: 

  • Azure Defender for IoT Getting Started launch page 



Thank you @kimwall for Sharing with the Community :stareyes:

Frequent Contributor

@kimwall as per @James van den Berg comment - thanks massively for sharing.


Quick question if I may? as I'm under a time crunch

When are the slide decks going to be available?


I'm specifically looking for the L300/400 details of exactly *how* the OT devices are secured in Air-gapped environments if the solution is relying on an agentless solution? how can that protect devices from potentially malicious content on USB devices being introduced inadvertently?


Dave C


Hello David. Apologies for the delay in answering your question. I've been out of the country for a few weeks. We are working on getting the slide decks/PDF's posted. However, I do not believe they will help with your specific question. When deploying Defender for IoT in an air-gapped environment, the sensor may be locally accessed and monitored without the need for a central manager. This solution is agentless and out-of-band and therefore not inline to any traffic. This is by design. Most industrial network owners resist solutions which are inline, place packets on the process control network, or require an in-band endpoint agent (any of these could potentially cause unplanned downtime, which is high on the list of things which should never happen in OT networks). Defender for IoT operates on SPAN'd/brokered network traffic and would see malicious activities when they happen - regardless of where they originate, including USB media. Note that the connection of the USB is not something that will be seen with this solution, but any network activity generated will be seen. Using patented machine-to-machine analytics, a baseline is learned and continually adjusted to ensure that good/authorized traffic is always known. When malicious traffic is introduced to the environment, it will inevitably deviate from the baseline of what is known to be good and one or more alerts will be raised at that time. 

Frequent Contributor

Thanks @kimwall,

We had a good discussion with customer and Lior - my bad, as it was the customer leading me astray with their specific use case.
When in reality they should be doing things correctly/securely and not necessarily taking shortcuts?


Dave C  

Respected Contributor

@David Caddick the slide decks have been added


Remind your customers that taking shortcuts frequently results in making it easier for attackers and cost more in the long run. 

Respected Contributor

@kimwall The Defender for IoT Architecture deck is still referring to CyberX. How much longer should we use that companies names in discussions with our Clients? they were purchase by MS quite a while ago. 

Respected Contributor

@kimwall  In the Sentinel Integration section, the link to Doc: Security Operations, Automation, and Response with Azure Sentinel does not work


@Dean Gross, thank you for pointing out the mis-functioning link. It has been removed for now. As for references to CyberX, I came to Microsoft as a part of that acquisition :smile: and am very much aware that the name has changed to Azure Defender for IoT. However, in the case of this video and deck, they were recorded shortly after the acquisition so it made sense to mention both. Going forward, this won't be the case, but depending on the session on this page, you may see or hear the previous name a time or two. Old habits die hard, but we are getting there. 

Senior Member

Hi There,


Enjoying this ninja and wondered if you could suggest a pcap source file that might be available to act as a useful training proof of concept that could be imported into a Sensor?


Thank you for all the great material.


Br Pete

Regular Visitor

Hello @kimwall and all,


I am enjoying studying the pile of material and yesterday my knowledge was further enriched by attending the Microsoft Security Partner Airlift FY22 – Secure OT/IoT Training.


Two questions remain: 1) what is the best way to achieving a certificate and 2) I ran into a mention of AZ-220, does it cover what we are learning on this Ninja page?


Kind regards,


Version history
Last update:
‎Aug 09 2021 06:55 AM
Updated by: