This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Microsoft Defender for IoT in the Microsoft Defender portal includes the Site security page, which offers an overview of the security state of your entire operational technology (OT) environment. Your organization's security team use this page to regularly monitor the security status of your production sites.
In this article, you learn how to set up a site in the Site security page.
Learn more about the site security benefits and use cases.
Important
This article discusses Microsoft Defender for IoT in the Defender portal (Preview).
If you're an existing customer working on the classic Defender for IoT portal (Azure portal), see the Defender for IoT on Azure documentation.
Learn more about the Defender for IoT management portals.
Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
To set up a site and associate the OT devices in your network to it:
In the Microsoft Defender portal menu, select Operational technology > Site security.
In the Site security page, select Create new site or Create Your First Site.
Type the following details:
When completed, select Next to associate devices to the site.
In this stage, you configure Defender for IoT to associate devices to the site, so it can correctly identify and associate all types of devices at the same site.
In the search bar, type either:
A list of suggested sites appears in the table.
If you don't know any of the site's device addresses:
Select Show all suggestions.
A list of all possible sites appears in the table. Each row in the table represents a suggested site location based on the devices in that location.
Open the location and check that at least one of these devices exists at your site.
Check each location, because Defender for IoT might list your devices in more than one suggested location. If this happens, select all of the suggested locations that include an identified device. You can select any number of locations. However, you can't edit the list of devices that appear at a specific location.
Review the devices and select the suggested sites to associate with the site. You might need to select more than one suggested site.
Use the Group column to check the ID for each suggested site. Sites with the same ID indicate that the devices are likely located at the same physical location. As these suggested sites are expected to belong to the same site, review and confirm that the devices listed are correct before making your selections and associating the suggested sites.
Select Next to review the site details.
Note
Currently, devices discovered in the Defender portal aren't synchronized with the Azure portal, and therefore the list of devices discovered could be different in each portal.
In this stage, you review all of the devices discovered by the system. This gives admins the opportunity to review and remove devices before confirming the site creation. A list of all devices to be associated with this site is displayed.
To manage devices in bulk, use the search bar to find devices by their name, IP, or MAC address.
If, during your editing, you want to reset the device list to its original state, selecting Discard all changes undoes any device exclusions and restores the initial device selection.
To remove any of the devices from this list:
Select Deselect devices from site. All of the devices become editable.
Deselect the checkbox of the devices to be removed.
When you're finished, select Next. The confirmation box appears.
Select Confirm to change the list of devices to associate with this site and removal of any unchecked devices.
If you haven't made changes, select Skip.
Important
When you exclude a specific device from site association, it is no longer assigned to sites based on network parameters. If the device is later moved to a different location, you’ll need to manually update its site settings, as automatic updates will not apply.
Review the information for the site you want to create:
Review the selected OT devices. If needed, select Edit devices to return to the Associate devices screen.
Select Complete.
The site is now set up and appears in the Site security page.
Regarding device data:
Select Create device group to create a device group now, or select Close and set up a device group at a later stage.
Use a device group to make sure that the correct users have access to the site. To create a device group:
Select Create device group.
The Settings > Endpoints > Device groups page opens.
Select Add device group and type a device group name.
Select the remediation level, type a description, and select Next.
The Devices page opens.
Type the value for the Tag condition in the format: Site: <Site name>. For example, Site: San Francisco.
Select Next.
The Preview devices page opens with a list of devices in the group.
Select Next.
The User access page opens.
Filter the user groups or select the user groups to add to the device group.
Select Submit and select Done.
Your device group is now set up and appears in the device groups list.
If a device group lists different preferences for the same user, you need to rank the importance of each device group.
To move a group up or down, drag the row to the correct position in the list. For more information, see ranking device groups in Microsoft Defender for Endpoint.
To get the full benefit of the Device group, you might need to create roles and permission settings. For more information, see role based access control in Microsoft Defender for Endpoint, and create and manage roles in Microsoft Defender for Endpoint.
Training
Module
Plan to deploy Microsoft Defender for IoT to monitor operational technology networks - Training
Learn how to plan your deployment of Microsoft Defender for IoT to monitor your OT network.
Certification
Microsoft 365 Certified: Endpoint Administrator Associate - Certifications
Plan and execute an endpoint deployment strategy, using essential elements of modern management, co-management approaches, and Microsoft Intune integration.