Question

A hospital operates a large fleet of IP security cameras, smart infusion pumps, and building-management controllers connected to the enterprise IT network (not an isolated OT segment). These devices run proprietary embedded firmware that cannot host any software agent. The security architect wants continuous vulnerability discovery and threat detection for these enterprise IoT devices, with alerts surfaced in the same Microsoft Defender XDR portal already used for endpoints. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable the Enterprise IoT security capability in Microsoft Defender for IoT, which uses Defender for Endpoint sensors already on the network to passively discover and monitor unmanaged IoT devices.

Answer

Deploy dedicated Defender for IoT OT network sensors with SPAN/TAP mirroring on each hospital VLAN and manage detections through the standalone Defender for IoT portal.

Answer

Install the Microsoft Defender for Endpoint agent directly on each camera, infusion pump, and building controller to collect telemetry.

Answer

Onboard the devices to Microsoft Intune with device-compliance policies and rely on Conditional Access to block non-compliant IoT endpoints.