Microsoft Defender for IoT

Provision the Microsoft Defender for IoT Micro Agent by using DPS

4 September 2026Doc update+13 / −12 lines

In brief

The article now specifies that the module twin and device module should use the same X.509 or CA certificate used for DPS enrollment. It also updates headings, links, metadata, and navigation structure.

What Defender admins need to know

Administrators have clearer certificate guidance when provisioning the micro agent through DPS; no required action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Provision the Microsoft Defender for IoT micro agent using by DPS

This article explains how to provision the standalone Microsoft Defender for IoT micro agent by using Azure IoT Hub Device Provisioning Service with X.509 certificate attestation. Follow this procedure to enroll a standalone device through DPS, create and configure a micro agent module, and verify that the agent connects successfully. If you're provisioning IoT Edge devices instead, see the Edge-device guidance linked below.

To learn how to configure the Microsoft Defender for IoT micro agent for Edge devices see Create and provision IoT Edge devices at scale

IoT Hub Device Provisioning Service.

Provision the device through DPS

Perform the following steps to provision the device through DPS:

Navigate into your destination IoT Hub.
Create a Defender for IoT micro agent module twin issued by the same ~~certificate.~~X.509 certificate used for the DPS enrollment.
Configure the micro agent to use the created module (note that the device does not have to exist yet).
Navigate to the configured device in the destination IoT Hub.
Create a new module for the device issued by the same CA ~~authenticator.~~certificate used for the DPS enrollment.
Run the micro agent that you configured to use the created module to confirm it connects to the device.

Related content

Configure Microsoft Defender for IoT agent-based solution

~~Configure pluggable Authentication Modules (PAM) to audit sign-in events (Preview)~~ \ No newline at end of file

Configure pluggable Authentication Modules (PAM) to audit sign-in events (Preview)

@@ -1,15 +1,15 @@ ----title: Provision the Microsoft Defender for IoT micro agent using DPS+title: Provision the Microsoft Defender for IoT Micro Agent by using DPS description: Learn how to provision the Microsoft Defender for IoT micro agent using DPS. -ms.date: 06/12/2026+ms.date: 07/03/2026 ms.topic: how-to ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- -# Provision the Microsoft Defender for IoT micro agent using DPS+# Provision the Microsoft Defender for IoT micro agent using by DPS -This article explains how to provision the standalone Microsoft Defender for IoT micro agent using [Azure IoT Hub Device Provisioning Service](/azure/iot-dps/about-iot-dps) with [X.509 certificate attestation](/azure/iot-dps/concepts-x509-attestation). Follow this procedure to enroll a standalone device through DPS, create and configure a micro agent module, and verify that the agent connects successfully. If you're provisioning IoT Edge devices instead, see the Edge-device guidance linked below.+This article explains how to provision the standalone Microsoft Defender for IoT micro agent by using [Azure IoT Hub Device Provisioning Service](/azure/iot-dps/about-iot-dps) with [X.509 certificate attestation](/azure/iot-dps/concepts-x509-attestation). Follow this procedure to enroll a standalone device through DPS, create and configure a micro agent module, and verify that the agent connects successfully. If you're provisioning IoT Edge devices instead, see the Edge-device guidance linked below.  To learn how to configure the Microsoft Defender for IoT micro agent for Edge devices see [Create and provision IoT Edge devices at scale](/azure/iot-edge/how-to-provision-devices-at-scale-linux-tpm) @@ -25,7 +25,8 @@ Before you begin, make sure you have the following prerequisites:  - [IoT Hub Device Provisioning Service](/azure/iot-dps/quick-setup-auto-provision). -## Provision+<a name="provision"></a>+## Provision the device through DPS  Perform the following steps to provision the device through DPS: @@ -39,7 +40,7 @@ Perform the following steps to provision the device through DPS:    1. Navigate into your destination IoT Hub. -1. [Create a Defender for IoT micro agent module twin](tutorial-create-micro-agent-module-twin.md) issued by the same certificate.+1. [Create a Defender for IoT micro agent module twin](tutorial-create-micro-agent-module-twin.md) issued by the same X.509 certificate used for the DPS enrollment.  1. [Configure the micro agent to use the created module](tutorial-standalone-agent-binary-installation.md#authenticate-using-a-module-identity-connection-string) (note that the device does not have to exist yet). @@ -47,15 +48,15 @@ Perform the following steps to provision the device through DPS:  1. Navigate to the configured device in the destination IoT Hub. -1. Create a new module for the device issued by the same CA authenticator.+1. Create a new module for the device issued by the same CA certificate used for the DPS enrollment.  1. Run the micro agent that you configured to use the created module to confirm it connects to the device.  > [!NOTE]-> When using this procedure, while you don't need the device to exist before configuring the agent, you do need to know the device name in advance in order to issue the certificate for the final module correctly.+> While you don't need the device to exist before configuring the agent when using this procedure, you do need to know the device name in advance in order to issue the certificate for the final module correctly. -## Next steps+## Related content -[Configure Microsoft Defender for IoT agent-based solution](tutorial-configure-agent-based-solution.md)+- [Configure Microsoft Defender for IoT agent-based solution](tutorial-configure-agent-based-solution.md) -[Configure pluggable Authentication Modules (PAM) to audit sign-in events (Preview)](configure-pam-to-audit-sign-in-events.md)\ No newline at end of file+- [Configure pluggable Authentication Modules (PAM) to audit sign-in events (Preview)](configure-pam-to-audit-sign-in-events.md)