Defender for IOT Activation file is not valid

Question

Defender for IOT Activation file is not valid

Timothy OBrien 10

We have a Defender for IoT OT sensor (software 26.1.0) that is unable to activate.
Uploading the activation file results in HTTP 500 errors and "internalSystemErrorMessage: This activation file is not valid".
We have fully deleted and recreated both the site and the sensor several times.
Azure consistently generates an activation file that the sensor rejects immediately.
Type: OT – Cloud Connected
The sensor shows correct UTC time.
The activation file comes directly from Sites & Sensors > Sensor > Onboard/Generate Activation File.
Sensor health-status API also returns 500. This appears to be a backend activation file generation issue.
Please validate activation file generation for this sensor and rebind the sensor ID in the backend.
We have installed several different versions of the sensor. We had this working before and just reloaded to add more storage.

0 comments

4 answers

Your answer

Answer 1

The described behavior matches a sensor-side rejection of the activation file, but backend validation or connectivity issues can also cause HTTP 500 responses.

Based on the available information, the following checks and remediation steps are supported:

Regenerate and re-upload the activation file
- Activation files are unique per OT sensor and are signed by root of trust. They also expire 14 days after creation.
- From Defender for IoT in the Azure portal, go to Sites and sensors, delete the problematic OT sensor, and onboard it again as an OT – Cloud Connected sensor. This recreates the sensor object and generates a new activation file.
- Download the new activation file from Sites and sensors (three dots on the sensor row → Download activation file), then upload it from the sensor console under System Settings > Sensor management > Subscription & Activation Mode and select Activate.
- If the activation file is valid but still rejected, download another activation file from the Sites and sensors page and try again.
Verify activation file freshness
- Ensure the activation file is uploaded within 14 days of creation. If it is older, regenerate it from the Azure portal and repeat the upload.
Check sensor connectivity to Azure
- If the sensor cannot connect to the internet or required Azure endpoints, activation can fail with backend errors.
- Verify the sensor’s network configuration and, if a proxy is required, confirm it is correctly configured on the Sensor Network Configuration screen.
- Ensure required outbound HTTPS (port 443) endpoints are allowed in the firewall/proxy. For OT sensors version 22.x, endpoint details can be downloaded from Sites and sensors → More actions → Download endpoint details; for other versions, see the networking requirements for sensor access to the Azure portal.
- During activation via the browser, if a connectivity problem is detected, use the Cloud connectivity pane (opened via Learn more under the activation error) to review causes and recommendations. Any time-drift issues must be resolved before proceeding.
Confirm the correct activation workflow
- Ensure the sensor has been properly onboarded in the Azure portal and that the activation file used matches that specific sensor (each OT sensor requires a unique activation file downloaded after onboarding).
- For new or redeployed sensors, follow the documented activation flow: configure via browser/CLI, then in the Activation tab upload the activation file and accept terms.
When HTTP 500 persists
- If repeated regeneration and upload of the activation file, along with confirmed connectivity and time synchronization, still result in HTTP 500 and “activation file is not valid,” the next supported step is to contact Microsoft Support. The documentation explicitly directs contacting Support when a valid activation file continues to be rejected and re-downloading does not resolve the issue.

References:

Answer 2

kagiyama yutaka 5,410

I think a new Defender for IoT activation file that returns HTTP 500 and not valid has no sensor‑side fix and the next action is to open a Support case with the subscription and sensor ID.

Timothy OBrien 10 Reputation points

2026-06-08T20:37:54.1633333+00:00

Support refused to help me unless we spend even more money. Having a 5pack wouldn't work. Will try to reach out to our reseller for help. There is no expiration date in the json that microsoft is generating in the expiration file and I believe that is the issue.
Zumrad Zhumanayev 0 Reputation points

2026-06-16T07:18:47.2533333+00:00

Hi, i have the same issue with activation. Sensor version 24.1.3. but i use on prem managment console locally managed sensor. If you alredy solved the issue please share with me.
Timothy OBrien 10 Reputation points

2026-06-16T11:48:22.03+00:00

Sorry I still have an open support case. It appears that the issuer.pem file when activations used to work (doesn't matter version) were previously azure rsa issuing ca 1-8. Defender sensor has it baked in to only allow certain subjects for the signature and the new activation files have a digicert subject name. I could be wrong, this is my guess. The apache2 logs actually say this on the Defender sensor if you putty in as cyberx or winscp as cyberx_host you can pull those logs. The engineers im working with have been top notch. I believe they will have this fixed soon.
kagiyama yutaka 5,410 Reputation points

2026-06-17T09:08:20.31+00:00

thanks for the update. let’s just wait for the official fix.

Answer 3

Zumrad Zhumanayev 0

Hi, i have the same issue with activation. Sensor version 24.1.3. but i use on prem managment console locally managed sensor. If you alredy solved the issue please share with me.

Timothy OBrien 10 Reputation points

2026-06-16T11:52:17.5966667+00:00

Sorry I still have an open support case. It appears that the issuer.pem file when activations used to work (doesn't matter version) were previously azure rsa issuing ca 1-8. Defender sensor has it baked in to only allow certain subjects for the signature and the new activation files have a digicert subject name. I could be wrong, this is my guess. The apache2 logs actually say this on the Defender sensor if you putty in as cyberx or winscp as cyberx_host you can pull those logs. The engineers im working with have been top notch. I believe they will have this fixed soon.

Answer 4

Timothy OBrien 10

This is what support did to fix it for me.

I take no responsibility and make no recommendation this will work for you. I am only posting this fix that worked for me for the purpose of transparency. Maybe the activation file someone else has is a different cert. Maybe the version you have is programmed differently and locations are different. I don't know so use at your own risk.

download a new activation file
before activating, login using your cyberx account to sensor cli.
run the following command:

run sed -i "s|'Microsoft Azure RSA TLS Issuing CA 08']|'Microsoft Azure RSA TLS Issuing CA 08',\n 'DigiCert Global G2 TLS RSA SHA256 2020 CA1']|" "/usr/lib/python3.11/site-packages/cyberx/ssl.py"

reboot
upload activation file

This is a bug they are working on and that fix was a workaround for me.

Adam Krein 5 Reputation points

2026-06-19T14:51:45.2433333+00:00

There is literally nothing else I can find on the internet out there for this issue. We have been banging out heads on the wall, using Claude and Gemini, and looking everywhere until I found this article. I have been testing with a new device and both versions of the iso 26 and 25 (latest of both that are stable releases) are rejecting the activation file immediately. Reading through MS website, it "should" have given a link under the Activate button to find out why it failed. It does not. I had to do some digging to find out how to login and change the password for the cyberx account (the setup doesn't walk you through that account anymore and only finished installing and taking you to a login screen where admin works but not the cyberx). You have to login to the admin account, change the password, access bash shell via the system option, run the command to reset the cyberx account, log out of admin and back in as cyberx, run the above command (don't include the "run" at the beginning and start with sed), once it's done you can type "reboot" and then go grab your activation file in Azure for the sensor (or use the one you should have already downloaded when setting up the new sensor in Azure) and boom, Bob's your uncle. I don't know about "on prem" but this is when setting up a cloud managed device. Hopefully they get this fixed. Thank you so much, Timothy. You sir, have won the internet for the week.
JimReprogle 0 Reputation points

2026-06-19T21:54:37.6733333+00:00

This was the exact fix for us. Thanks for posting. It was valuable.