Back to Checks
azure

Defender for IoT Hub is set to On

defender_ensure_iot_hub_defender_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/iotsecuritysolutions

Microsoft Defender for IoT security solution exists in the subscription and reports status Enabled for monitored IoT Hub resources.

Prowler logoProwlerprowler-provider-azure

Risk

Without Defender for IoT, device activity lacks telemetry and alerting, degrading CIA:

  • Compromised devices join botnets and exfiltrate data
  • Abused device identities alter cloud twins and commands
  • Lateral movement from IoT networks to Azure workloads This blind spot increases dwell time and blast radius.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_iot_hub_defender_is_on

Recommendation

Enable Defender for IoT on all IoT Hubs and keep it Enabled. Route security data to a central workspace and your SIEM. Apply least privilege to IoT identities, enforce network segmentation and private access, and use defense in depth with continuous monitoring, alert tuning, and periodic coverage reviews.

Remediation

Terraform

# Enable Defender for IoT by creating an IoT Security Solution
resource "azurerm_iot_security_solution" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<LOCATION>"
  display_name        = "<example_resource_name>"
  iothub_ids          = ["<IOT_HUB_RESOURCE_ID>"]  # CRITICAL: links the IoT Hub; creating this solution enables Defender
}

NativeIaC

// Enable Defender for IoT by creating an IoT Security Solution
resource iotDefender 'Microsoft.Security/iotSecuritySolutions@2019-08-01' = {
  name: '<example_resource_name>'
  location: '<LOCATION>'
  properties: {
    displayName: '<example_resource_name>'
    iotHubs: ['<IOT_HUB_RESOURCE_ID>']  // CRITICAL: links the IoT Hub; creating this solution enables Defender for IoT
    status: 'Enabled'                   // CRITICAL: ensures the solution is enabled
  }
}

Other

1In the Azure portal, go to IoT hubs and open your hub
2Select Defender for IoT > Overview
3Click Secure your IoT solution and complete onboarding (select the hub if prompted)
4If you see a toggle, set Enable Microsoft Defender for IoT to On and Save
5Verify the IoT Security Solution shows as Enabled under Defender for IoT

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_iot_hub_defender_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            iot_security_solutions,
        ) in defender_client.iot_security_solutions.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if not iot_security_solutions:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.status = "FAIL"
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status_extended = f"No IoT Security Solutions found in the subscription {subscription_name} ({subscription_id})."
                findings.append(report)
            else:
                for iot_security_solution in iot_security_solutions.values():
                    report = Check_Report_Azure(
                        metadata=self.metadata(),
                        resource=iot_security_solution,
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"The security solution {iot_security_solution.name} is enabled in subscription {subscription_name} ({subscription_id})."

                    if iot_security_solution.status != "Enabled":
                        report.status = "FAIL"
                        report.status_extended = f"The security solution {iot_security_solution.name} is disabled in subscription {subscription_name} ({subscription_id})"

                    findings.append(report)

        return findings

References