Microsoft Defender for IoT - OT site license - XL Annual Subscription (12 Months)
PRODUCT DESCRIPTION
Microsoft Defender for IoT OT Site Licence XL Annual Subscription (CFQ7TTC0MLTF:0002) - Local Support
Agentless Monitoring for Operational Technology Networks
Microsoft describes the OT side of Defender for IoT this way: "OT network sensors use agentless, patented technology to discover, learn, and continuously monitor network devices for a deep visibility into Operational Technology (OT) / Industrial Control System (ICS) risks. Sensors carry out data collection, analysis, and alerting on-site, making them ideal for locations with low bandwidth or high latency." Nothing is installed on the controllers themselves, which is the point: industrial equipment usually cannot take an agent.
Licensed Per Site, Sized by Device Count — This Licence Covers Up to 5,000 Devices
Defender for IoT OT is not licensed per user or per device. Microsoft: "OT monitoring is billed using site-based licenses, where each license applies to an individual site, based on the site size." A site is defined as "a physical location, such as a facility, campus, office building, hospital, rig, and so on. Each site can contain any number of network sensors, all of which monitor devices detected in connected networks." This XL licence covers up to 5,000 devices at one site.
Not Included in Microsoft 365 E5 — and Not the Same as Enterprise IoT
Two things buyers routinely conflate. First, Microsoft states that the OT site licence is not included in the Microsoft 365 E5 or E5 Security packages; it is bought separately. Second, Enterprise IoT is a different product: it is a per-device add-on that Microsoft does bundle with Microsoft 365 E5, where "With each user license, customers can protect up to five eIoT devices", and it covers corporate devices such as printers and cameras. The OT site licence does not cover Enterprise IoT devices, and Enterprise IoT does not cover OT.
You Will Need Sensor Appliances, and an Azure Subscription
This is not a licence you switch on from a portal and walk away from. Microsoft requires a Microsoft tenant with Global admin or Billing admin access to the Microsoft 365 admin centre, an Azure subscription linked to that tenant, and a Security Admin, Contributor or Owner role on it. On top of that you deploy network sensors on SPAN or TAP: Microsoft publishes hardware profiles from the C5600 (up to 3 Gbps, 12,000 assets) through the E1800, E1000 and E500 (up to 1 Gbps, 10,000 assets) down to the L500 and L100 for production-line monitoring, with a 100 GB minimum disk. Talk to us before you order so the appliance side is costed too.
Defender for IoT OT Site Licence XL Annual Subscription Datasheet — Licensing and Specifications
This Licence
| Site size | XL |
| Devices covered | Up to 5,000 devices at one site |
| Licensed by | Per site. Microsoft: "Purchase a license for each site that you're planning to monitor" |
| Microsoft's definition of a site | "A physical location, such as a facility, campus, office building, hospital, rig, and so on. Each site can contain any number of network sensors" |
| Included in Microsoft 365 E5? | No. Microsoft states the OT site licence is not included in the Microsoft 365 E5 or E5 Security packages |
| Term | Twelve months. Microsoft: "Each Microsoft 365 license lasts for one year", with longer-term options through Microsoft sales |
| Minimum purchase | Not published by Microsoft |
Microsoft's Published Site Size Ladder
| XS | Up to 100 devices per site |
| S | Up to 250 devices per site |
| M | Up to 500 devices per site |
| L | Up to 1,000 devices per site. Not among the site licences listed here — ask our team if your site falls between 500 and 1,000 devices |
| XL | Up to 5,000 devices per site |
| Above 5,000 devices | Microsoft directs buyers to their Microsoft sales representative, and documents 2XL and 3XL tiers available through seller assistance |
Sensor Appliance Profiles Microsoft Publishes
| C5600 | Up to 3 Gbps, 12,000 assets, physical or virtual — for mixed IT and OT monitoring |
| E1800, E1000, E500 | Up to 1 Gbps, 10,000 assets — for site-level monitoring |
| L500 | Up to 200 Mbps, 1,000 assets — production line monitoring |
| L100 | Up to 10 Mbps, 800 assets — production line monitoring |
| Minimum disk | 100 GB. The L60 profile is deprecated |
| Included in this licence? | No. Appliances are separate and are not supplied with the subscription |
Data Residency and Retention
| Where the data sits | European Union and United States only. Microsoft: "Defender for IoT uses the Microsoft Azure data centers in the European Union and the United States", placed by the tenant geolocation identified at provisioning or by the data storage rules of the online service |
| Asia-Pacific option | None published. A Singapore tenant's Defender for IoT cloud data will sit outside Asia |
| Retention | "Data from Defender for IoT is retained for as long as a customer is active or for 90 days after the end of your contract". Devices and alerts are held 90 days in the Azure portal and on the OT sensor |
| Alert packet captures | Cached 48 hours in the portal; between 2.5 GB and 130 GB on the sensor depending on the hardware profile |
| On-sensor event timeline | Stored on the sensor only and "isn't limited by time", retaining at least 90 days at around 500 events per day on all hardware profiles |
What Microsoft Does Not Publish for This Product
The following are commonly asked about but are not stated on any current official Microsoft source for this product, so SourceIT does not quote them: a definition of what counts as a device for licensing purposes, a minimum purchase quantity, whether unused capacity in a larger tier can be split across sites, any Asia-Pacific data residency option for OT monitoring and a mapping between the commerce SKU identifier and this site size. We would rather leave a field blank than print a figure we cannot substantiate.
Lifecycle, End of Support and Entitlement
SourceIT sells this as a twelve-month subscription with a GST invoice in Singapore. The subscription is a right to use the service for the term, not a perpetual licence: when the term ends the entitlement ends unless it is renewed.
Microsoft's lifecycle page places Defender for IoT under the Modern Lifecycle Policy, with a start date of 4 January 2021 and a status of "In Support". No retirement date is published, and the Modern Lifecycle Policy commits Microsoft to "a minimum of 12 months' notification prior to ending support if no successor product or service is offered". The licensing model itself changed: from 1 June 2023 OT monitoring licences are purchasable only in the Microsoft 365 admin centre, site-based and sized by site, replacing the earlier Azure-billed committed-device model. Existing customers may continue on a legacy OT plan already onboarded to an Azure subscription with no change in functionality, but cannot add a new plan to a new subscription without a corresponding Microsoft 365 admin centre licence. If a licence lapses, Microsoft publishes a 30-day grace period from the last expired licence, after which the service stops and data retention ends 90 days later.
Talk to our team before the renewal date rather than after it. Seat counts, mid-term changes and co-terming with the rest of your Microsoft estate are all easier to arrange in advance, and we can quote the alternatives if a bundle would work out better for you.
Published Lifecycle Dates
| Lifecycle policy | Modern Lifecycle Policy |
| Start date | 4 January 2021 |
| Status | "In Support"; no retirement date published |
| Licensing model change | Site-based licensing from 1 June 2023, purchased in the Microsoft 365 admin centre |
| Grace period on lapse | 30 days from the last expired licence, then the service stops; data retention ends 90 days later |
| Former name | Azure Defender for IoT, previously Azure Security Center for IoT |
Support and Entitlement Position
This is a software subscription, not hardware. It carries no hardware warranty, and any warranty term you see on a hardware listing does not apply here. What you are buying is a twelve-month right to use the service, together with SourceIT's local support in Singapore. Microsoft's own condition is that technical and billing support for a subscription bought through a partner runs through that partner, so for this subscription that means us: raise the ticket with SourceIT and we escalate to Microsoft where it needs to go. Renewal, seat changes and co-terming are handled on your SourceIT account. Ask our team for the current entitlement position in writing with your quotation.
Compatibility, Deployment and System Requirements
Sizing is the whole game here, and Microsoft is specific about how to do it: in the Microsoft Defender portal, go to Assets, then Devices, select the IoT/OT devices tab and "Note down the total number of devices listed". That count decides which site size you need. Microsoft does not publish a definition of what counts as a device for licensing purposes — whether transient or duplicate network entities count, for instance — which is the most likely source of a sizing dispute at renewal. Get the count agreed in writing before you commit.
Purchasing runs through the Microsoft 365 admin centre rather than Azure. Microsoft's instruction is to go to Billing, then Purchase services or Marketplace, and search for Defender for IoT. All licence management — buying, cancelling, renewing, auto-renew and auditing — happens there. You will still need the linked Azure subscription for the service itself.
Microsoft publishes five standard site sizes. The L tier — up to 1,000 devices per site — is not among the site licences listed here; it sits between the M and XL licences. If your site count falls between 500 and 1,000 devices, ask our team and we will quote it rather than defaulting you to XL.
Prerequisites and Sizing
| Tenant | A Microsoft tenant with Global admin or Billing admin access to the Microsoft 365 admin centre |
| Azure | An Azure subscription linked to that tenant, with a Security Admin, Contributor or Owner role |
| Sensors | Network sensors deployed on SPAN or TAP. Not included in this licence |
| Where to buy | Microsoft 365 admin centre, Billing then Purchase services or Marketplace |
| How to count devices | Microsoft Defender portal, Assets, Devices, IoT/OT devices tab |
Official Microsoft Sources & Downloads
- Microsoft Defender for IoT plans and pricing
- Defender for IoT licences overview (Microsoft Learn)
- Defender for IoT billing and site-based licensing (Microsoft Learn)
- Manage Defender for IoT OT plans and licences (Microsoft Learn)
- Defender for IoT OT appliance sizing (Microsoft Learn)
- Defender for IoT data retention and residency (Microsoft Learn)
- Manage licences for Defender for IoT, including how to count devices (Microsoft Learn)
- Secure IoT devices in the enterprise, OT compared with Enterprise IoT (Microsoft Learn)
- Microsoft Defender for IoT lifecycle (Microsoft Learn)
- Modern Lifecycle Policy (Microsoft Learn)
Where a figure appears on this page it is quoted from one of these Microsoft pages; where Microsoft publishes nothing, this page says so rather than filling the gap. Supplied by SourceIT in Singapore with a GST invoice and local support. For a written quotation, current stock position or delivery lead time, contact our team.
Frequently Asked Questions — Defender for IoT OT Site Licence XL Annual Subscription
How do we know which site size to buy?
By device count at that site. Microsoft's published ladder is XS up to 100 devices, S up to 250, M up to 500, L up to 1,000 and XL up to 5,000, with 2XL and 3XL available through Microsoft sales above that. Count the devices on the IoT/OT devices tab in the Microsoft Defender portal. This licence is the XL size, covering up to 5,000 devices at one site.
We have Microsoft 365 E5. Is this included?
No. Microsoft states that the Defender for IoT OT site licence is not included in the Microsoft 365 E5 or E5 Security packages and must be bought separately. What E5 does include is Enterprise IoT, a different product covering corporate devices such as printers and cameras, at up to five devices per user licence. Enterprise IoT does not cover operational technology and this licence does not cover Enterprise IoT devices.
Does the licence include the sensors?
No. The sensors are appliances you deploy on your own network taps, and they are not supplied with this subscription. Microsoft publishes hardware profiles from the C5600 at up to 3 Gbps and 12,000 assets down to the L100 at up to 10 Mbps and 800 assets, with a 100 GB minimum disk. Tell us your network topology and we will help you size the appliance side as well as the licence.
Where is the data stored?
The European Union or the United States, and nowhere else. Microsoft states: "Defender for IoT uses the Microsoft Azure data centers in the European Union and the United States." There is no Asia-Pacific option published for OT monitoring, so a Singapore tenant's cloud data will sit outside Asia. If that is a compliance problem for your organisation, raise it with us before you order.
What happens if the licence lapses?
Microsoft publishes a 30-day grace period from the last expired licence in which you can renew. After that the Defender for IoT service stops, and data retention stops 90 days later. Because the appliances keep collecting locally, the practical effect is that you lose the cloud side first. Talk to us ahead of the renewal date rather than after it.
