Configure a micro agent twin

Learn how to configure a micro agent twin.

Note

Defender for IoT plans to retire the micro agent on August 1, 2025.

Prerequisites

• An Azure account. If you do not already have an Azure account, you can create your Azure free account today.

• A Defender for IoT subscription.

• An existing IoT Hub with: A connected device, and A micro agent module twin.

Micro agent configuration

To view and update the micro agent twin configuration:

1. Navigate to the Azure portal.

2. Search for, and select IoT Hub.

   

3. Select your IoT Hub from the list.

4. Under the Device management section, select Devices.

   

5. Select your device from the list.

6. Select the module ID.

   

7. In the Module Identity Details screen, select Module Identity Twin.

   

8. Change the value of any field by adding the field to the "desired" section with the new value.

   

   For example:

   "desired": {
       "Baseline_Disabled": false,
       "Baseline_MessageFrequency": "Low",
       "Baseline_GroupsDisabled": "",
       "Baseline_ChecksDisabled": "",
       "SystemInformation_Disabled": false,
       "SystemInformation_MessageFrequency": "Low",
       "SBoM_Disabled": false,
       "SBoM_MessageFrequency": "Low",
       "NetworkActivity_Disabled": false,
       "NetworkActivity_MessageFrequency": "Medium",
       "NetworkActivity_Devices": "eth0",
       "NetworkActivity_CacheSize": 256,
       "Process_Disabled": false,
       "Process_MessageFrequency": "Medium",
       "Process_PollingInterval": 100000,
       "Process_Mode": 1,
       "Process_CacheSize": 256,
       "LogCollector_Disabled": false,
       "LogCollector_MessageFrequency": "Low",
       "Heartbeat_Disabled": false,
       "Heartbeat_MessageFrequency": "Low",
       "Login_Disabled": false,
       "Login_MessageFrequency": "Medium",
       "IothubModule_MessageTimeout": 2880,
       "CollectorsCore_PriorityIntervals": "30,120,1440"
   }
   

   For the full list of supported properties, see Micro agent configurations.

   The agent successfully set the new configuration if the value of "latest_state", under the "reported" section shows "success".

   

   If the agent fails to set the new configuration, the value of "latest_state", under the "reported" section will show "failed". If this occurs, the "latest_invalid_fields" will contain a list of the fields that are invalid.

Next steps

You learned how to configure a micro agent twin. For more information about micro agent configurations and event aggregation, see:

• Micro agent configurations

• Micro agent event collection