Question

A manufacturing company operates several OT/ICS production sites that use PLCs and SCADA systems. Corporate security policy requires that raw operational network traffic never leave the plant floor and that no external internet connectivity be permitted from the OT VLANs. However, the central SOC team needs consolidated OT alerts correlated with IT signals in Microsoft Sentinel, and they want a single management console for sensor health and threat intelligence updates. Which Defender for IoT deployment approach best satisfies both requirements?

Accepted Answer

Deploy locally managed OT network sensors on the plant floor and forward only alert metadata to Sentinel through an on-premises management console positioned in the IT/OT DMZ, keeping raw packet capture on-premises.

Answer

Deploy cloud-connected OT network sensors on each plant floor and allow outbound HTTPS from the OT VLAN so telemetry streams directly to the Defender for IoT cloud service.

Answer

Install the Defender for Endpoint agent on each PLC and SCADA host so alerts are reported directly to the Defender portal without needing network sensors.

Answer

Configure a single cloud-connected sensor in the corporate datacenter and span all plant-floor traffic to it over the WAN for centralized analysis.