Hello everyone, Context To understand how defender for iot for device builders work, I am linking log analytics workspace to the defender for IoT as per this document. https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-configure-agent-based-solution#enable-data-collection I followed the instructions to setup resource provider and access control for log analytics workspace. https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-configure-agent-based-solution#enable-data-collection Then I went to enable Defender for iot --> settings --> data collection to link the log analytics workspace. Challenge faced I am facing the following error FailedDependency Unable to read Log Analytics workspace /subscriptions/.../providers/microsoft.operationalinsights/workspaces/law-defender-for-iot, please make sure to grant the required permissions to access the Defender for IoT experience ... Would need the community's help to understand If I missed giving any access permissions for this attachment to succeed or what to do to solve this or any leads would help? Thanks.

Hi Arjun Sivasree Below error suggests that we need to add "Defender for IOT " or "Azure Security for IoT" as Log Analytics Contributor from the concerned log analytics IAM. FailedDependency Unable to read Log Analytics workspace /subscriptions/.../providers/microsoft.operationalinsights/workspaces/law-defender-for-iot, please make sure to grant the required permissions to access the Defender for IoT experience .. Please make sure you have followed the steps on access controls and other required steps as mentioned in this document. Thank you.

Failed dependency error while trying to link a log analytics workspace to defender for iot within iot hub.

Accepted answer

Manas Mohanty 945 Reputation points Microsoft External Staff

2025-02-13T16:15:38.7433333+00:00

Hi Arjun Sivasree

Below error suggests that we need to add "Defender for IOT " or "Azure Security for IoT" as Log Analytics Contributor from the concerned log analytics IAM.

FailedDependency Unable to read Log Analytics workspace /subscriptions/.../providers/microsoft.operationalinsights/workspaces/law-defender-for-iot, please make sure to grant the required permissions to access the Defender for IoT experience..

Please make sure you have followed the steps on access controls and other required steps as mentioned in this document.

Thank you.
Please sign in to rate this answer.

1 person found this answer helpful.
Arjun Sivasree 60 Reputation points

2025-02-13T17:03:49.87+00:00

Thanks for pointing it out. I was adding IAM access in the IoT hub itself and got confused with the previous step of giving access to the IoT Hub.

Anyways, i get another error now as follows;

Unable to enable intelligence pack in Log Analytics workspace '/subscriptions/.../providers/microsoft.operationalinsights/workspaces/law-defender-for-iot', please make sure to grant the required permissions to access the Defender for IoT experience.

Manas Mohanty 945 Reputation points Microsoft External Staff

2025-02-14T08:22:06.3366667+00:00

Hi Arjun Sivasree

Please make sure you have enabled these two-resource provider from subscription-Microsoft.IoTSecurity,Microsoft.OperationsManagement

You have provided "Contributor role" to "Azure Security for IOT" on IOT Hub IAM and added "Azure Security for IoT" as log analytics contributor on your log analytics works . Reference

You have followed all steps in Data collection In-depth security recommendations and custom alerts, IP data collection

You can enable intelligence-pack through CLI if above does not work.
az monitor log-analytics workspace pack enable --name <intelligence-pack-name> --resource-group <resource-group-name> --workspace-name <workspace-name>

Thank you.

Manas Mohanty 945 Reputation points Microsoft External Staff

2025-02-14T13:41:13.26+00:00

Hi Arjun Sivasree

Could you confirm whether the CLI command or the above pointer fixed your issues.

Thank you

Arjun Sivasree 60 Reputation points

2025-02-14T16:15:29.48+00:00

Thanks for detailed steps.

I can confirm steps 1 and 2 as complete. Though I am not sure of step 3. Would you please provide documentation link for same?

For step 4, which intelligence pack should I enable? I have already enabled "AzureSecurityOfThings" intelligence pack but that did not fix the issue.

Thanks.

Manas Mohanty 945 Reputation points Microsoft External Staff

2025-02-14T16:44:34.6866667+00:00

Hi Arjun Sivasree

As a work around, you can run below CLI command from cloud shell to enable intelligence-packs.

az login --identity az account set --subscription "<subid>" az monitor log-analytics workspace pack enable --name <intelligence-pack-name> --resource-group <resource-group-name> --workspace-name <workspace-name>

Thank you

Arjun Sivasree 60 Reputation points

2025-02-24T17:27:42.5966667+00:00

I tried this and enabled AzureSecurityOfThings intelligence pack from a terminal on the home page "https://portal.azure.com/#home" and it still doesn't link. Do you have any specific intelligence pack in mind that I would have to enable?

Arjun Sivasree 60 Reputation points

2025-02-24T17:49:08.8266667+00:00

Ok. I got this to work finally.

I checked the activity logs of logs analytics workspace and found the intelligence pack that defender for IoT was trying to enable.

Highlighting points 2 and 3 in the image, you can see that defender started to enable intelligence pack "Security" but was failing to add it.

Adding the same using the CLI commands given in previous comments helped solve the issues.

az monitor log-analytics workspace pack enable --name AzureSecurityOfThings --resource-group <resource-group-name> --workspace-name <workspace-name> az monitor log-analytics workspace pack enable --name Security --resource-group <resource-group-name> --workspace-name <workspace-name>

So, in total, I added 2 security packs: "AzureSecurityOfThings" and "Security".

Thanks for helps folks. Will come back soon for more :). Keep helping.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Failed dependency error while trying to link a log analytics workspace to defender for iot within iot hub.

0 additional answers

Your answer