Elisity integrates with Microsoft Defender for IoT to enhance device discovery and asset intelligence for IoT and OT environments. This integration automatically synchronizes device information, vulnerabilities, and security insights from Defender for IoT sensors into the IdentityGraph, providing enriched context for policy decisions. Organizations using Microsoft's IoT security platform can leverage this data to strengthen their zero-trust segmentation strategies across operational technology networks.
The Microsoft Defender for IoT integration enables Elisity to automatically enrich devices with critical OT/IoT intelligence including vendor information, device types, firmware versions, industrial protocols, and authorization status. This eliminates manual device classification effort and enables policy-based segmentation decisions based on real-time device context from Defender sensors.
How It Works
Defender for IoT sensors run on-premises, so Cloud Control Center does not query them directly. Instead, your Virtual Edges query the sensors over your internal network. Sensor data stays inside your network, and no internet exposure or API gateway is required.
Site Labels determine which Virtual Edges query which sensor. Each sensor endpoint is mapped to one or more Site Labels, and Site Labels are assigned to Virtual Edge Nodes, the switches where Elisity discovers devices. When a device needs enrichment, Cloud Control Center asks a Virtual Edge that manages Virtual Edge Nodes in one of the sensor's Site Labels to query the sensor. These are the Virtual Edges for that sensor, and each of them needs HTTPS (port 443) access to it. For example, if a sensor is mapped to the Site Label "Building-A", any Virtual Edge that manages a Virtual Edge Node labeled "Building-A" can be asked to query that sensor.
A Defender for IoT sensor is not a Virtual Edge Node and is not managed by a Virtual Edge. The Virtual Edge Node only links a sensor to its Virtual Edges through the Site Label; the query itself goes directly from the Virtual Edge to the sensor. Virtual Edges continue to manage their Virtual Edge Nodes while they query sensors, so no dedicated Virtual Edge is required.
Key Benefits
| Benefit | Description |
|---|---|
| Automated Device Classification | Defender identifies device types (PLCs, HMIs, RTUs, IP cameras, etc.) and Elisity uses this for automatic policy group assignment |
| Vendor and Model Intelligence | Leverage Defender's device fingerprinting for vendor-specific policies (e.g., "Rockwell PLCs") |
| Firmware Tracking | Identify vulnerable devices needing updates and segment by patch level |
| Protocol Visibility | Create policies based on industrial protocol usage (Modbus, BACnet, etc.) detected by Defender |
| Rogue Device Detection | Automatically quarantine devices marked as unauthorized by Defender |
| No Internet Exposure | Sensors remain internal; Virtual Edges handle queries over your existing network infrastructure |
| Scalable | Supports up to 100 sensors with up to 8,000 devices per sensor |
Prerequisites
- Virtual Edge version 16.13.0 or higher
- Microsoft Defender for IoT with sensor-based deployment (not cloud-only)
- Administrative access to Defender for IoT sensor management console
- Network connectivity on port 443 (HTTPS) from Virtual Edges to Defender for IoT sensors. A sensor is queried by the Virtual Edges that manage Virtual Edge Nodes in its Site Labels, so each of those Virtual Edges must be able to reach it
- Configured Site Labels in Elisity topology
- Super Admin or Tenant Admin role in Cloud Control Center
Design Considerations
Review these deployment requirements and constraints before configuring the integration.
Deployment Requirements
| Requirement | Constraint |
|---|---|
| Virtual Edges for Each Sensor | Enrichment for a sensor runs on the Virtual Edges that manage Virtual Edge Nodes in the sensor's Site Labels. Each of these Virtual Edges needs HTTPS (port 443) access to the sensor. A centralized Virtual Edge that manages Virtual Edge Nodes at remote sites can query the sensors at those sites |
| Site Label Mapping | A sensor can be assigned to multiple Site Labels, and multiple sensors can share the same Site Label |
| Scale per Sensor | 8,000 devices maximum |
| Total Sensors Supported | 100 sensors maximum |
Shared Site Labels: When several sensors share a Site Label, Cloud Control Center checks those sensors in a fixed order and enriches each device from the first sensor that has data for it. Because the order does not change, a device seen by more than one sensor is enriched from the same sensor each time. The order does not depend on the Endpoint Name, so renaming a sensor does not change it.
Before You Begin
Inventory Your Defender Sensors: Document each sensor, the sites it monitors, and roughly how many devices it sees. If any sensor monitors more than 8,000 devices, or your deployment has more than 100 sensors, contact Elisity for scale planning before you begin.
Map Sensors to Site Labels: For each sensor, list the Site Labels of the devices it monitors. Where several sensors monitor one site, such as a large site or a physically segmented OT network, assign that Site Label to each of those sensors. Where one site uses separate Site Labels, such as one for IT and one for OT, assign all of them to the sensor that monitors the site. Keep this mapping for troubleshooting.
Identify the Virtual Edges for Each Sensor: Using the Site Labels from the previous step, identify the Virtual Edges that manage Virtual Edge Nodes in each sensor's Site Labels. Confirm they have capacity to query the sensor alongside Virtual Edge Node management.
Verify Network Connectivity: From each of those Virtual Edges, confirm that the sensor is reachable on port 443. Test connectivity using: curl -k https://<sensor-ip-or-hostname>/api/v1/devices
Prepare for Multi-Sensor Configuration: Each sensor requires its own API token, a unique Endpoint Name, and a separate endpoint configuration.
Configuration
This section walks you through configuring the Microsoft Defender for IoT connector in Cloud Control Center. The integration requires generating API tokens from each Defender sensor and configuring endpoints in Elisity.
Step 1: Generate API tokens in Microsoft Defender for IoT
You must generate a unique API token for each Defender for IoT sensor in your deployment.
- Access the local sensor management console by navigating to
https://<sensor-ip-or-hostname>in your web browser. - Log in with administrative credentials.
- Navigate to System Settings in the left sidebar menu.
- Click Access Tokens (or API Tokens, depending on your sensor version).
- Click Generate New Token or Create API Token.
- Configure the token settings with a descriptive name such as "Elisity IdentityGraph Integration", select Device Inventory Read or equivalent read-only permission, and choose token validity period if applicable.
- Click Generate or Create.
- Copy the token immediately and store it securely. Most Defender versions display the token only once and it cannot be retrieved later.
- Repeat these steps for each Defender sensor in your deployment.
Step 2: Add the Microsoft Defender for IoT connector and configure the first sensor
Log into Cloud Control Center and navigate to IdentityGraph > Connectors. Click + Add Connector, search for or locate the Microsoft Defender for IoT tile, and click Configure.
The Add Microsoft Defender for IoT page opens with the endpoint configuration for the first sensor.
- Configure the endpoint settings:
- Endpoint Name: Enter a name that identifies the sensor, such as "Building A Sensor". The name must be unique within the connector and is not case-sensitive.
-
Endpoint URL: Enter the sensor URL in the format
https://<sensor-ip-or-hostname>. Examples:https://192.168.100.50orhttps://sensor-building-a.company.com - API Token: Paste the token generated in Step 1 for this sensor
- Site Label(s): Select one or more Site Labels where this sensor's monitored devices exist. Choose Site Labels that match the network locations of devices monitored by this sensor. An endpoint can be assigned to multiple Site Labels if a sensor monitors devices across multiple network locations, and the same Site Label can also be assigned to other sensors.
- Description (optional): Enter additional details about the sensor, such as "Building A production floor sensor"
- Click Add. Before saving the endpoint, Cloud Control Center validates the sensor through a Virtual Edge that manages Virtual Edge Nodes in the selected Site Labels. If validation fails, an error message is displayed and the endpoint is not saved.
Validation Results
| Status | Description |
|---|---|
| Success | The sensor endpoint is saved and ready to use |
| Credentials Verification Failed (Unauthorized) | The API token is invalid, expired, or lacks permissions, or the Endpoint URL is incorrect |
| No Virtual Edge Answered | No online Virtual Edge manages Virtual Edge Nodes in the selected Site Labels, or none completed the validation request in time. Check that a Virtual Edge is online for the selected Site Labels and can reach the sensor |
Step 3: Add additional sensors
Each additional sensor is added as another endpoint of the same connector. Navigate to IdentityGraph > Connectors, click + Add Connector, and click Configure on the Microsoft Defender for IoT tile. Complete the endpoint form as described in Step 2 and click Add. Repeat for each sensor in your deployment.
Step 4 (optional): Review global settings
Global Settings apply to every sensor in the connector. To open them, locate the Microsoft Defender for IoT connector row on the IdentityGraph > Connectors page, select the Actions (three-dot) menu, and choose Global Settings. The Global Settings dialog contains two tabs: Advanced Settings and Interval Settings.
Most deployments can leave the Advanced Settings and Interval Settings tabs at their default values. Review and modify these tabs only if your deployment has specific requirements, then click Submit.
Advanced Settings
The Advanced Settings tab controls which devices are queried for enrichment, how stale data is purged, how far back device activity is considered, and whether this connector is treated as an authoritative identity source.
- Query Exclusion Rules: Enable the options in this section to prevent the platform from querying the connector for additional details about the matching devices. Subnet excludes devices in one or more subnets you specify (up to 100). Virtual Edge Node excludes devices reported by selected Virtual Edge Nodes (up to 100). Random MAC excludes devices that use randomized (private) MAC addresses. Subnet and Virtual Edge Node exclusions are off by default, and Random MAC exclusion is on by default.
- Connector Data Purging: When this feature is enabled, Cloud Control Center purges all data learned about a device from this connector if the device is no longer found when querying the connected application. The time period between purge events is configurable and can be set between 1 and 90 days (default: 7 Days).
- Enrichment Lookback Window: Defines how far back IdentityGraph looks for device activity when determining enrichment eligibility. Increasing this window may improve coverage but can increase processing load (default: 3 Days).
- Trusted Connector: Sets enrichment from this source to Trusted for Policy Groups and designates this connector as an authoritative identity source for Insights.
Interval Settings
The Interval Settings tab controls connector polling timing.
- Initial Delay: A configurable delay, in seconds, before Cloud Control Center checks the connector for updates (default: 180 seconds).
After reviewing the settings, click Submit to apply any modifications.
Step 5: Verify connector activation
After adding all sensor endpoints, the connector begins its first refresh cycle immediately. Navigate to IdentityGraph > Connectors to view connector status. The Microsoft Defender for IoT connector appears as a parent row whose status reflects the status of its sensors. Expand the row to display one row per sensor, listed by Endpoint Name in the Connector / Endpoint Name column with its own status. Verify that the connector and each sensor show Active status with recent refresh timestamps within the configured refresh interval (default: 3 minutes). If any sensor shows Inactive or Degraded status, proceed to the Troubleshooting section for resolution steps.
Verify the Integration
After configuring the connector, verify that enrichment is working correctly by checking device enrichment data.
View Enriched Device Data
Navigate to IdentityGraph > Devices and select a device that is monitored by one of your Defender for IoT sensors. Click the device to view its details page and scroll to the Connectors or Enrichment Data section. Locate the Microsoft Defender for IoT section and verify that attributes are populated with data from Defender.
The Microsoft Defender for IoT section displays enrichment data including vendor information, device type, operating system, firmware version, detected protocols, authorization status, and other attributes collected by the Defender sensor. Check the Last Updated timestamp to confirm recent enrichment.
Understanding Enrichment Behavior
Site Label-Based Enrichment: Each device is enriched by a sensor whose Site Labels include the device's Site Label, which comes from the Virtual Edge Node where the device is discovered. For example, a device discovered on a Virtual Edge Node labeled "Building-A" is enriched by a sensor endpoint assigned to "Building-A". When several sensors share that Site Label, the first sensor with data for the device is used, as described in Design Considerations.
Automatic Enrichment: Enrichment occurs automatically on a 3-minute refresh cycle (default). When a Virtual Edge Node discovers a new device, one of the Virtual Edges for the matching sensor queries that sensor immediately to retrieve device attributes. No manual intervention is required.
Manual Refresh (optional): On the device details page, you can manually trigger enrichment by clicking Refresh Now or Refresh Enrichment. Enrichment typically completes within 5-30 seconds, depending on sensor response time. Verify that the Last Updated timestamp changes to the current time to confirm the refresh succeeded.
Troubleshooting
| Issue | Resolution |
|---|---|
| 401 Unauthorized | API token is invalid, expired, or lacks permissions. Verify the token was copied correctly. Log into the Defender sensor console and verify the token exists with device inventory read access. Generate a new API token, then edit the sensor endpoint, enter the new token, and save the endpoint. Validation runs when the endpoint is saved. |
| Connection Timeout | Virtual Edge cannot reach the sensor. Verify the sensor URL is correct and the sensor is online. Test connectivity manually: curl -k https://<sensor-ip-or-hostname>/api/v1/devices. Check firewall rules allow traffic on port 443. Verify DNS resolution if using hostname. If the sensor is reachable but the error continues, contact Elisity Support. |
| Connector Status: Degraded | Some sensor endpoints are working while others are failing. Expand the connector row on the Connectors page to view the status of each sensor. Identify which endpoints show Inactive or error status. Review error messages for each failing endpoint and troubleshoot individually using the steps for specific error types. Working endpoints continue enriching devices during troubleshooting. |
| Device Not Enriched | Device is not receiving enrichment data. Verify the device exists in the Defender sensor with a MAC address (required for matching). Confirm the device is in a Site Label assigned to at least one sensor endpoint. Check that the Virtual Edge Node where the device is discovered has the correct Site Label. Verify the connector status is Active. Review query exclusion rules to ensure the device is not being filtered. Try manual refresh on the device to trigger immediate enrichment. |
| No Virtual Edge Available | No Virtual Edge is available to query the sensor. Verify that at least one Virtual Edge that manages Virtual Edge Nodes in the sensor's Site Labels is online and can reach the sensor on port 443. Confirm Virtual Edges are running version 16.13.0 or higher. Verify that the sensor endpoint's Site Labels match the Site Labels assigned to Virtual Edge Nodes in the topology. |
| Slow Enrichment | Devices take longer than expected to receive enrichment data. Check CPU and memory on the Virtual Edges that manage Virtual Edge Nodes in the sensor's Site Labels, and look for competing workloads. Check sensor response times and network latency between those Virtual Edges and the sensor. If enrichment remains slow, contact Elisity Support for capacity planning. |
Maintenance Tasks
Rotating API Tokens
API tokens should be rotated periodically as part of security best practices. Recommended schedule: Every 90-180 days or per your organization's security policy.
Process: Log into the Defender sensor management console and navigate to System Settings then Access Tokens. Generate a new API token with the same permissions and copy the new token. In Cloud Control Center, navigate to IdentityGraph > Connectors, expand the Microsoft Defender for IoT connector row, select the Actions (three-dot) menu on the sensor's row, and choose Edit Endpoint. Enter the new token in the API Token field and save the endpoint. Validation runs when the endpoint is saved. Verify endpoint status returns to Active within one refresh cycle.
Updating Sensor Network Information
If a Defender sensor's IP address or hostname changes, choose Edit Endpoint on the sensor's row as described above. Update the Endpoint URL with the new address and save the endpoint. Validation runs when the endpoint is saved. Verify endpoint status shows Active. No API token change is needed unless the token was also regenerated.
Removing Decommissioned Sensors
When a Defender sensor is permanently removed from your deployment, navigate to IdentityGraph > Connectors, expand the Microsoft Defender for IoT connector row, select the Actions (three-dot) menu on the decommissioned sensor's row, and choose Delete Endpoint. Confirm the deletion. If the sensor is the only endpoint in the connector, deleting it also deletes the connector. Devices previously enriched by that sensor retain cached data but do not receive updates. To keep enriching those devices, add their Site Label to another sensor endpoint that monitors them.
Best Practices
Start with a Pilot Sensor: For large deployments with many sensors, configure one endpoint first. Verify enrichment works correctly for one week before adding remaining sensors.
Document Sensor-to-Site Label Mappings: Maintain documentation showing which Defender sensor monitors which Site Labels. This is critical for troubleshooting and for planning sensor additions or changes. Use descriptive Endpoint Names, such as the building or facility each sensor monitors.
Monitor Virtual Edge Resource Utilization: After deployment, monitor CPU and memory usage on the Virtual Edges that query your sensors. Set alerts for utilization exceeding 80%.
Establish Token Rotation Schedule: Create a schedule for rotating API tokens every 90-180 days. Document procedures and ensure multiple team members can perform the task.
Review Global Settings Carefully: Leave Global Settings at default values unless you have specific requirements. Query exclusion rules and interval settings should only be modified after understanding their impact on enrichment behavior.