Check ID: defender_ensure_iot_hub_defender_is_on
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/iotsecuritysolutions

​
What this check verifies

Microsoft Defender for IoT security solution exists in the subscription and reports status Enabled for monitored IoT Hub resources.

​
Risk

Without Defender for IoT, device activity lacks telemetry and alerting, degrading CIA:
  • Compromised devices join botnets and exfiltrate data
  • Abused device identities alter cloud twins and commands
  • Lateral movement from IoT networks to Azure workloads This blind spot increases dwell time and blast radius.

​
Recommendation

Enable Defender for IoT on all IoT Hubs and keep it Enabled. Route security data to a central workspace and your SIEM. Apply least privilege to IoT identities, enforce network segmentation and private access, and use defense in depth with continuous monitoring, alert tuning, and periodic coverage reviews.

​
Remediation

# Enable Defender for IoT by creating an IoT Security Solution
resource "azurerm_iot_security_solution" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<LOCATION>"
  display_name        = "<example_resource_name>"
  iothub_ids          = ["<IOT_HUB_RESOURCE_ID>"]  # CRITICAL: links the IoT Hub; creating this solution enables Defender
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_iot_hub_defender_is_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks