Question

A manufacturing company operates several plants with programmable logic controllers (PLCs), SCADA systems, and human-machine interfaces (HMIs) on isolated operational technology (OT) networks. Security leadership wants continuous asset discovery and threat detection across these OT networks without disrupting production processes or requiring software agents on the industrial devices. The solution must feed alerts into the organization's existing Microsoft Sentinel workspace. What should the security architect recommend?

Accepted Answer

Deploy Microsoft Defender for IoT network sensors using passive (agentless) traffic monitoring via SPAN/TAP and forward alerts to Microsoft Sentinel via the data connector

Answer

Install the Microsoft Defender for Endpoint agent on each PLC, SCADA server, and HMI to gather telemetry and onboard the devices to Defender for Cloud

Answer

Onboard the OT devices to Azure Arc and apply the Microsoft Cloud Security Benchmark to enforce endpoint baselines

Answer

Route all OT network traffic through Microsoft Entra Internet Access with a Security Service Edge policy to inspect and log industrial protocols