Configure a Microsoft Defender for IoT micro agent twin

The Microsoft Defender for IoT micro agent twin lets you customize the security agent's behavior for each device. By editing the module identity twin's desired properties in the Azure portal, you can control settings such as message frequency, collector enablement, and cache sizes. This article walks you through viewing and updating those configuration properties in IoT Hub. Before you begin, make sure you have the required Azure account, Defender for IoT subscription, and IoT Hub setup described in the Prerequisites.

Note

Defender for IoT plans to retire the micro agent on June 1, 2027.

Prerequisites

Before you configure the micro agent twin, make sure you have the following prerequisites:

Micro agent configuration

To view and update the micro agent twin configuration:

  1. Navigate to the Azure portal.

  2. Search for, and select IoT Hub.

    Screenshot of searching for the IoT hub in the search bar.

  3. Select your IoT Hub from the list.

  4. Under the Device management section, select Devices.

    Screenshot of the device management section of the IoT hub.

  5. Select your device from the list.

  6. Select the module ID.

    Screenshot of the device's module ID selection screen.

  7. In the Module Identity Details screen, select Module Identity Twin.

    Screenshot of the Module Identity Details screen.

  8. Change the value of any field by adding the field to the "desired" section with the new value.

    Screenshot of the sample output of the module identity twin.

    For example:

    "desired": {
    "Baseline_Disabled": false,
    "Baseline_MessageFrequency": "Low",
    "Baseline_GroupsDisabled": "",
    "Baseline_ChecksDisabled": "",
    "SystemInformation_Disabled": false,
    "SystemInformation_MessageFrequency": "Low",
    "SBoM_Disabled": false,
    "SBoM_MessageFrequency": "Low",
    "NetworkActivity_Disabled": false,
    "NetworkActivity_MessageFrequency": "Medium",
    "NetworkActivity_Devices": "eth0",
    "NetworkActivity_CacheSize": 256,
    "Process_Disabled": false,
    "Process_MessageFrequency": "Medium",
    "Process_PollingInterval": 100000,
    "Process_Mode": 1,
    "Process_CacheSize": 256,
    "LogCollector_Disabled": false,
    "LogCollector_MessageFrequency": "Low",
    "Heartbeat_Disabled": false,
    "Heartbeat_MessageFrequency": "Low",
    "Login_Disabled": false,
    "Login_MessageFrequency": "Medium",
    "IothubModule_MessageTimeout": 2880,
    "CollectorsCore_PriorityIntervals": "30,120,1440"
}

    For the full list of supported properties, see Micro agent configurations.

    The micro agent successfully set the new configuration if the value of "latest_state", under the "reported" section shows "success".

    Screenshot of a successful configuration change.

    If the micro agent fails to set the new configuration, the value of "latest_state", under the "reported" section will show "failed". If the configuration update fails, the "latest_invalid_fields" will contain a list of the fields that are invalid.

Related content

  • Last updated on