What you are evaluating
OT monitoring is distinct from Enterprise IoT features associated with Defender for Endpoint. The legacy on-premises management console retired in January 2025; individual air-gapped sensors remain supported. The documented Defender portal experience is preview, so this profile uses the Azure portal and sensor workflow.
A useful evaluation context
Microsoft-oriented SOCs that need an explicit OT collection design, including sites that cannot send data to the cloud.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- OT sensors analyze observed industrial network traffic without installing agents on controllers.
- Azure-connected sensors provide central visibility and integration with services such as Sentinel.
- Air-gapped sensors retain local console and API management paths.
Where it fits in the work
- Plan the site, zones, mirror port and sensor-management connectivity.
- Fine-tune the lab sensor and review the learning baseline before operational monitoring.
- Investigate a sensor alert and verify that exported evidence retains the correct device and time context.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Follow the official deployment learning path in an isolated virtual lab. Draw separate paths for monitored traffic, sensor administration and optional Azure connectivity.
Evidence to look for
Show where an alert is analyzed during a simulated cloud connection outage. Do not introduce the retired management console into the target architecture.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which OT plan, sensor version and management experience are being purchased?
- How will disconnected sites receive updates and export investigation evidence?
- Is any proposed capability dependent on the preview Defender portal experience?