Daily Defender News
Aboutmerill.net
Microsoft Defender for IoT
General

Create and Manage Users on an On-premises Management Console

4 September 2026Doc update+37 / −33 lines

In brief

The article now presents its user-management procedures more clearly, including prerequisites as notes, revised wording and links, and updated metadata.

What Defender admins need to know

Admins can more easily find procedures and required permissions. No administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create and manage users on an on-premises management console (Legacy)

Microsoft Defender for IoT provides tools for managing on-premises user access in the OT network sensor, and the on-premises management console. Azure users are managed at the Azure subscription level using Azure RBAC. For more information, see Manage users and user access.

This sectionarticle describes how to managecreate, edit, and delete on-premises users directlyusers, change passwords, recover privileged access, integrate with Active Directory, define global access permissions, and control session timeouts on an on-premises management console. Each procedure lists the required permissions as prerequisites.

Default privileged users

This procedure describes how to create new users for an on-premises management console.

Prerequisites: This procedure is available for the support and cyberx users, and any user with the Admin role.

To add a user:

  1. Sign in to the on-premises management console and select Users > + Add user.

    |Password | Select the user type, either Local or Active Directory User.

    For local users, enter a password for the user. Password requirements include:
    - At least eight characters
    - Both lowercase and uppercase alphabetic characters
    - At least one number
    - At least one symbol|

To reset a user's password on the on-premises management console:console:

  1. Sign into the on-premises management console and select Users.

Recover privileged access to an on-premises management console

This procedure describesThe following steps describe how to recover either the support or cyberx user password on an on-premises management console. For more information, see Default privileged on-premises users.

Prerequisites: This procedure is available for the support and cyberx users only.

To recover privileged access to an on-premises management console:

  1. Start signing in to your on-premises management console. On the sign-in screen, under the Username and Password fields, select Password recovery.

  2. In the Password Recovery dialog, select either CyberX or Support from the drop-down menu, and copy the unique identifier code that's displayed to the clipboard.

  3. Go the Defender for IoT Sites and sensors page in the Azure portal. You may want to open the Azure portal in a new browser tab or window, keeping your on-premises management console open.

    In your Azure portal settings > Directories + subscriptions, make sure that you've selected the subscription where your sensors were onboarded to Defender for IoT.

  4. Back on the on-premises management console tab, on the Password recovery dialog, select Upload. Browse to an upload the password_recovery.zip file you downloaded from the Azure portal.

To recover privileged access to an on-premises management console:

  1. Start signing in to your on-premises management console. On the sign-in screen, under the Username and Password fields, select Password recovery.

  2. In the Password Recovery dialog, select either CyberX or Support from the drop-down menu, and copy the unique identifier code that's displayed to the clipboard.

  3. Go the Defender for IoT Sites and sensors page in the Azure portal. You might want to open the Azure portal in a new browser tab or window, keeping your on-premises management console open.

    In your Azure portal settings > Directories + subscriptions, make sure that you've selected the subscription where your sensors were onboarded to Defender for IoT.

  4. Back on the on-premises management console tab, on the Password recovery dialog, select Upload. Browse to an upload the password_recovery.zip file you downloaded from the Azure portal.

For more information, see Microsoft Entra ID support on sensors and on-premises management consoles.

Prerequisites: This procedure is available for the support and cyberx users only, or any user with an Admin role.

To integrate with Active Directory:

  1. Sign in to your on-premises management console and select System Settings.

For more information, see On-premises global access groups

To integrate with Active Directory:

  1. Sign in to your on-premises management console and select System Settings.

For more information, see On-premises global access groups.

Prerequisites:

This procedure is available for the support and cyberx users, and any user with the Admin role.

Before you create access groups, we also recommend that you:

  • Carefully set up your business topology. For a rule to be successfully applied, you must assign sensors to zones in the Site Management window. For more information, see Create OT sites and zones on an on-premises management console

    Before you create access groups, we also recommend that you:

    To create access groups:groups:

    1. Sign in to the on-premises management console as user with an Admin role. 

      :::image type="content" source="../media/how-to-define-global-user-access-control/add-access-group.png" alt-text="Screenshot of adding an Active Directory group to a Global Access Group." lightbox="../media/how-to-define-global-user-access-control/add-access-group.png":::

If the option doesn't appear, and you want to include Active Directory groups in access groups, make sure that you've included your Active Directory group in your Active Directory integration. For more information, see [Integrate on-premises users with Active Directory](#integrate-users-with-active-directory).
      • Add local users to your groups by editing existing users from the Users page. On the Users page, select the Edit button for the user you want to assign to the group, and then update the Remote Sites Access Group value for the selected user. For more information, see Add new on-premises management console users.

    If you later modify a topology entity and the change affects the rule logic, the rule is automatically deleted.

    If modifications to topology entities affect rule logic so that all rules are deleted, the access group remains but users won't be able to sign in to the on-premises management console. Instead, users are notified to contact their on-premises management console administrator for help with signing in. Edit each affected user (see Add new on-premises management console users) to update their Remote Sites Access Group assignment so that they're no longer part of the legacy access group.

    Control user session timeouts

    Prerequisites:[!NOTE] This procedure is available for the support and cyberx users only.

To control on-premises management console user session timeouts:timeouts:

  1. Sign in to your sensoron-premises management console via a terminal and run: 

    sudo nano /var/cyberx/properties/authentication.properties

  2. Do one of the following:

    • To turn off user session timeouts entirely,entirely, change infinity_session_expiration = true to infinity_session_expiration = false. Change it back to turn it back on again.

    • To adjust an inactivity timeout period,period, adjust one of the following values to the required time, in seconds:

      • session_expiration_default_seconds for all users
      • session_expiration_admin_seconds for Admin users only
      • session_expiration_security_analyst_seconds for Security Analyst users only
      • session_expiration_read_only_users_seconds for Read Only users only

Next stepsRelated content

For more information, see: