How to recover manually deleted OT devices from Defender for IoT ?

Question

How to recover manually deleted OT devices from Defender for IoT ?

Rushikesh Kulkarni 0

Hello ,
I have a cloud-connected OT Sensor. Sensor detected the network traffic & generated the OT Device Inventory. The same inventory was coming up on the Azure.

However , the firmware version was not showing up for any of the assets. The network traffic is very low around 30 PPS (Packets Per Second). May I know why it is not showing the firmware versions?
For troubleshooting, I deleted the devices from both consoles, viz. Sensor's Local Console and Azure Portal.
I am wondering that the devices are not coming up on the inventory pages (Local & Azure). Is there any way to recover the devices discovered earlier ?

Thanks,
Rushikesh

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-18T10:51:05.4333333+00:00

Hello Rushikesh Kulkarni,

Please confirm if you have any further queries on this.
Rushikesh Kulkarni 0 Reputation points

2026-03-20T15:09:43.8166667+00:00

Hello , When I am doing some network activity the PPS count is increasing. Alerts are also getting generated for OT devices. On Azure portal , it's showing source & destination IP addresses as unclassified. Defender for IoT is not adding the new devices.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-26T10:17:53.0266667+00:00
Hello Rushikesh Kulkarni,

Once devices are deleted from the sensor console and Azure, they cannot be restored. Defender for IoT does not provide a recovery option, so devices will only reappear when the sensor detects them again from live network traffic.

In your scenario, traffic and alerts are visible but IPs are still unclassified. This indicates the sensor is receiving packets, but not enough information to identify the devices.

Please check:

Traffic includes identifiable OT protocols (such as Modbus, DNP3, S7). Generic traffic will not be sufficient for classification.

SPAN/TAP is configured to send full bidirectional traffic.

The sensor is connected to the correct network segment where devices are actively communicating.

After deletion, discovery starts fresh and may take time, especially with low traffic.

Sensor health and Azure connectivity are functioning correctly.

Regarding firmware, it is expected to remain empty if the required details are not present in the observed traffic.

Next steps: generate relevant OT protocol traffic, validate SPAN/TAP configuration, and allow time for rediscovery. If devices still do not appear, capturing traffic from the sensor will help confirm what is being detected.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-27T18:54:16.51+00:00

Hello Rushikesh Kulkarni,

Any update on this? Please confirm if you have further queries on this.
Rushikesh Kulkarni 0 Reputation points

2026-04-01T11:09:07.6333333+00:00

Hello team ,
Could you please suggest the firm solution to rediscover deleted assets ? It's been more than 3 weeks , I deleted the assets manually. The deleted assets are showing on the Data Mining Reports.
Does Defender for IoT create a ghost entry for such assets ? What is the cool down period so that it will start discovering or treating deleted assets as Authorized devices ?

Waiting for your reply. Please do not provide the automated response.

Thanks,

Rushikesh

2 answers

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-18T10:51:05.4333333+00:00

Hello Rushikesh Kulkarni,

Please confirm if you have any further queries on this.
Rushikesh Kulkarni 0 Reputation points

2026-03-20T15:09:43.8166667+00:00

Hello , When I am doing some network activity the PPS count is increasing. Alerts are also getting generated for OT devices. On Azure portal , it's showing source & destination IP addresses as unclassified. Defender for IoT is not adding the new devices.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-26T10:17:53.0266667+00:00

Hello Rushikesh Kulkarni,

Once devices are deleted from the sensor console and Azure, they cannot be restored. Defender for IoT does not provide a recovery option, so devices will only reappear when the sensor detects them again from live network traffic.

In your scenario, traffic and alerts are visible but IPs are still unclassified. This indicates the sensor is receiving packets, but not enough information to identify the devices.

Please check:

Traffic includes identifiable OT protocols (such as Modbus, DNP3, S7). Generic traffic will not be sufficient for classification.

SPAN/TAP is configured to send full bidirectional traffic.

The sensor is connected to the correct network segment where devices are actively communicating.

After deletion, discovery starts fresh and may take time, especially with low traffic.

Sensor health and Azure connectivity are functioning correctly.

Regarding firmware, it is expected to remain empty if the required details are not present in the observed traffic.

Next steps: generate relevant OT protocol traffic, validate SPAN/TAP configuration, and allow time for rediscovery. If devices still do not appear, capturing traffic from the sensor will help confirm what is being detected.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-27T18:54:16.51+00:00

Hello Rushikesh Kulkarni,

Any update on this? Please confirm if you have further queries on this.
Rushikesh Kulkarni 0 Reputation points

2026-04-01T11:09:07.6333333+00:00

Hello team ,
Could you please suggest the firm solution to rediscover deleted assets ? It's been more than 3 weeks , I deleted the assets manually. The deleted assets are showing on the Data Mining Reports.
Does Defender for IoT create a ghost entry for such assets ? What is the cool down period so that it will start discovering or treating deleted assets as Authorized devices ?

Waiting for your reply. Please do not provide the automated response.

Thanks,

Rushikesh

Answer 1

Deleting devices from the OT sensor console or from Defender for IoT inventories is not reversible. There is no supported way to “recover” previously discovered devices once they have been manually deleted from the inventory.

On an OT sensor, when devices are deleted from the Device map or Device inventory, they are removed from the inventory database. The guidance for merge operations explicitly notes that incorrect merges must be corrected by deleting and waiting for rediscovery, which also applies conceptually here: the only way to get devices back is for the sensor to rediscover them from live network traffic.

For rediscovery to occur:

The OT sensor must still be properly connected and monitoring the relevant SPAN/TAP or network segment.
The devices must generate sufficient network traffic again so the sensor can identify them as devices.
Once rediscovered on the sensor, cloud-connected sensors will repopulate the Azure portal device inventory based on the new detections.

If traffic is very low (around 30 PPS), rediscovery can take time or may not occur until the devices communicate in ways that allow the sensor to fingerprint them again.

Regarding firmware versions: the provided context does not describe any specific requirement or guarantee that firmware versions will always be populated. Defender for IoT device inventory surfaces device data detected from network traffic; if the observed protocols and traffic do not expose firmware information, the firmware field can remain empty even when devices are discovered and listed.

Summary:

Manually deleted devices cannot be restored from a backup or recycle bin in Defender for IoT.
Devices will reappear only when the OT sensor rediscovers them from network traffic.
Firmware version fields may remain blank if the traffic being inspected does not reveal that information.

References:

Answer 2

Hi Rushikesh Kulkarni •

There is no recovery, cooldown, or “re‑authorization” mechanism for manually deleted OT devices in Defender for IoT. Once deleted, those device entities are permanently removed from the active inventory. Defender for IoT does not create ghost entries, and it will not automatically rediscover them unless new qualifying network traffic is observed again.

To answer your question explicitly:

QueryAnswerCool‑down period after deletion?❌ NoTime‑based rediscovery?❌ NoAuto‑treat deleted devices as Authorized later?❌ NoHidden ghost device entries?❌ NoData Mining Reports ≠ Device Inventory

Data Mining uses historical packet metadata
It shows IP/MAC/protocol evidence that existed in the past
It does not recreate or validate device entities

So:

Seeing assets in Data Mining reports does not mean they are active, authorized, or recoverable
These are forensic artifacts, not inventory objects

This is normal and expected behavior.

There are only three supported methods to make deleted assets reappear:

Option 1: Generate qualifying OT traffic (most common fix)

If operationally allowed:

Open engineering software and go online with PLC/HMI
Perform a read‑only status check
Trigger protocol identity exchanges

This is the most reliable rediscovery trigger.

Option 2: Validate SPAN/TAP coverage

Check on the sensor:

Monitoring interface counters are increasing
No excessive packet drops
Correct VLANs mirrored
Both ingress and egress traffic present

Many rediscovery issues are actually visibility issues.

Option 3: Restore from backup (only way to “recover” history)

If (and only if) you have:

Sensor VM snapshot
Sensor backup/export from before deletion

Then restoring that snapshot will bring back:

Original device entities
Historical attributes
Authorizations

Without a backup, recovery is impossible.

What Defender for IoT will NOT do (important)

❌ It will not “remember” deleted devices
❌ It will not re‑authorize based on historical evidence
❌ It will not promote Data Mining artifacts into inventory
❌ It will not rediscover devices without new traffic.

Reference used

https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-investigate-sensor-detections-in-a-device-inventory

https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/back-up-restore-sensor#restore-an-ot-sensor

https://learn.microsoft.com/en-us/defender-for-iot/manage-devices-inventory

Thank you.