Daily Defender News
Aboutmerill.net
Microsoft Defender for IoT
Identity protection

Set up Single Sign-on for Microsoft Defender for IoT Sensor Console

4 September 2026Doc updateAction required+18 / −19 lines

In brief

The Defender for IoT SSO article now identifies Microsoft Graph User.Read as the required permission and states that an administrator must grant tenant-wide consent. Wording, headings, metadata, and related-content formatting were also updated.

What Defender admins need to know

When configuring SSO, ensure the application has User.Read and obtain tenant-wide admin consent so users can sign in without individual approval prompts.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Set up single sign-on for the sensor console

In this article, you learnThis article shows how to set up single sign-on (SSO) for the Defender for IoT sensor console usingconsole. SSO uses Microsoft Entra ID. With SSO,ID so your organization's users can simply sign into the sensor console, andin once. They don't need multiple loginseparate credentials across different sensors and sites.for each sensor or site.

Using Microsoft Entra ID simplifies the onboardingmakes it easier to add or remove users, reduces admin work, and offboarding processes, reduces administrative overhead, and ensures consistentkeeps access controls consistent across theyour organization.

  • Add outbound allow rules to your firewall, proxy server, and so on. You can access the list of required endpoints from the Sites and sensors page.

  • If you don't have existing Microsoft Entra ID user groups to use for SSO authorization, work with your organization's identity manager to create relevant user groups.

  • Verify that you have the following permissions:

    • A Member user on Microsoft Entra ID.
    • Admin, Contributor, or Security Admin permissions on the Defender for IoT subscription.

  • Ensure that each user has a First name, Last name, and User principal name.

  • If needed, set up Multifactor authentication (MFA).

    • Under Name, type a name for your application.
    • Under Supported account types, select Accounts in this organizational directory only (Microsoft only - single tenant).
    • Under Redirect URI, add an IP or hostname for the first sensor on which you want to enable SSO. You continue to add URIs for the other sensors in the next step, Add your sensor URIs.
:::image type="content" source="media/set-up-sso/register-application.png" alt-text="Screenshot of registering an application on Microsoft Entra ID." lightbox="media/set-up-sso/register-application.png":::
  1. Select Register.
  2. Under Redirect URIs, the URI for the first sensor, added in Create application ID on Microsoft Entra ID, is displayed under Redirect URIs. To add the rest of the URIs:

    1. Select Add URI to add another row, and type an IP or hostname.

    2. Repeat this step for the rest of the connected sensors.

      When Microsoft Entra ID adds the URIs successfully, a "Your redirect URI is eligible for the Authorization Code Flow with PKCE" message is displayed.

      :::image type="content" source="media/set-up-sso/authentication.png" alt-text="Screenshot of setting up URIs for your application on the Microsoft Entra ID Authentication page." lightbox="media/set-up-sso/authentication.png":::

  3. Select Save.

Grant the application requiredAPI permissions

GrantYour registered application needs the required API permissions for your application:default Microsoft Graph User.Read permission to sign in users. An admin must grant tenant-wide consent so that all users can use SSO without individual approval prompts.

  1. In your new application, select API permissions​.

  2. Next to Add a permission, selectSelect Grant admin consent for <Directory name>.

    :::image type="content" source="media/set-up-sso/api-permissions.png" alt-text="Screenshot of setting up API permissions in Microsoft Entra ID." lightbox="media/set-up-sso/api-permissions.png":::

Test sign-in with SSO

To test signing in with SSO: ​

  1. Open Defender for IoT on the Azure portal, and select SSO Sign-in.

    :::image type="content" source="media/set-up-sso/sso-sign-in.png" alt-text="Screenshot of the sensor console login screen with SSO.":::

  2. For the first sign in, in the Sign in page, type your personal credentials (your work email and password).

    :::image type="content" source="media/set-up-sso/sso-first-sign-in-credentials.png" alt-text="Screenshot of the Sign in screen when signing in to Defender for IoT on the Azure portal via SSO.":::

The Defender for IoT Overview page is displayed. ​ ​

Next stepsRelated content

For more information, see: