How should I connect my 4G LTE gateway to the IoT central with SAS Token?

Mohit patel 0 Reputation points
2026-04-20T08:27:33.2966667+00:00

I have currently deployed my 4G GSM IoT gateway which I am connecting with IoT Central. When I run my code on the gateway, the output comes on terminal stating that the device is Attempting to connect to Azure., [MQTT] Connected to Azure IoT Central.,[MQTT] Attempting to connect to Azure. That means the my gateway connection with Azure Centeral has a successful TLS handshake but the Device Authentication via SAS token gets unsuccessful and states that the device failed to connect.

Azure IoT Central
Azure IoT Central

An Azure hosted internet of things (IoT) application platform.

3 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-04-20T08:27:53.5933333+00:00

    Use a per‑device SAS key derived from an IoT Central SAS enrollment group and let the device authenticate via DPS using that key, the device ID, and the ID scope.

    For a 4G LTE gateway, the key points are:

    1. Ensure the device is using DPS, not a raw IoT Hub connection string
      • IoT Central expects devices to connect through Device Provisioning Service (DPS).
      • The device must send:
        • ID scope (of the IoT Central app)
        • Device ID
        • SAS key (or SAS token derived from that key)
      • The device then receives its IoT Hub connection details from DPS and connects using those.
      See: “How devices connect” and “Authenticate and connect device”.
    2. Create or use a SAS enrollment group in IoT Central
      • In IoT Central, use a SAS enrollment group (for example the default SAS-IoT-Devices) to manage symmetric keys.
      • Each device must have a unique device ID.
      • The enrollment group holds the group‑level primary/secondary keys.
    3. Derive a per‑device key from the group primary key
      • From the SAS enrollment group, copy the group primary key.
      • Use Azure CLI to compute the device key: 
             az extension add --name azure-iot
     az iot central device compute-device-key \
       --primary-key <enrollment group primary key> \
       --device-id <your-device-id>
      • Flash/store on the gateway:
        • Device ID (must match what you used above)
        • Device SAS key (output of the command)
        • IoT Central ID scope (from Permissions > Device connection groups in IoT Central)
    4. Let the device generate SAS tokens from the device key
      • At runtime, the gateway should generate a SAS token from the device key, not from the group key.
      • The token must be valid for the DPS/Iot Hub resource and within its expiry time.
      • The SDKs typically do this automatically when given the device key.
    5. Use the correct model ID and auto‑registration behavior
      • If relying on automatic registration, the device does not need to be pre‑created in IoT Central.
      • The device must:
        • Use the correct ID scope and device key as above.
        • Send the model ID so IoT Central can assign the device to the correct device template.
    6. Typical failure causes in this scenario
      • Device key not derived from the correct SAS enrollment group primary key.
      • Device ID on the device does not match the ID used when computing the device key.
      • Using the group key directly on the device instead of a per‑device key.
      • Wrong ID scope (from another IoT Central app or environment).
      • SAS token expired or signed for the wrong resource.

    To fix the current failure:

    1. In IoT Central, confirm the ID scope and group primary key from Permissions > Device connection groups > SAS-IoT-Devices.
    2. Recompute the device key using az iot central device compute-device-key with the exact device ID used by the gateway.
    3. Update the gateway configuration with:
      • ID scope
      • Device ID
      • Device key (not the group key)
    4. Ensure the device SDK is configured to use DPS with SAS and that it generates the SAS token from this device key.

    If done correctly, the TLS handshake will succeed (as it already does) and SAS authentication via DPS/IoT Central should also succeed.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. SRILAKSHMI C 19,735 Reputation points Microsoft External Staff Moderator
    2026-04-21T15:49:41.18+00:00

    Hello @Mohit patel,

    Thank you for reaching out. Based on the behavior you described, the device is successfully establishing a TLS connection, which confirms that network connectivity and endpoint resolution are working correctly. The failure is occurring during SAS token authentication, which typically indicates an issue with token generation or connection configuration while connecting to Azure IoT Central.

    Please review the following checks to help isolate and resolve the issue:

    1. Verify Device Registration

    Ensure that the device is properly created in IoT Central:

    Navigate to Devices → + New

    Confirm the following details:

    • Device ID (case-sensitive and must match exactly)
    • Scope ID (ID Scope)
    • Primary/Secondary Key

    Ensure the device status is Enabled

    2. Validate SAS Token Generation

    The SAS token must follow the correct structure:

    SharedAccessSignature sr={scopeId}/devices/{deviceId}&sig={signature}&se={expiry}

    Key validations:

    Resource URI (sr) must be:

    {scopeId}/devices/{deviceId}

    String-to-sign:

    {scopeId}/devices/{deviceId}\n{expiry}

    Signature (sig):

    Generated using HMAC-SHA256

    Use Base64-decoded device key

    Output must be Base64 encoded and URL encoded

    Expiry (se):

    Must be a future UNIX timestamp

    Common issues observed:

    • Incorrect resource URI
    • Signature not URL encoded
    • Using incorrect device key
    • Expired token

    3. Check Device Time Synchronization

    SAS tokens are time-sensitive.

    • Ensure the gateway system clock is synchronized
    • A time drift of more than a few minutes can result in authentication failure

    4. Confirm MQTT Configuration

    Please ensure the MQTT client is configured as follows:

    • Host: {yourAppName}.azure-devices.net
    • Port: 8883
    • Client ID: <deviceId>
    • Username: {scopeId}/?api-version=2018-06-30
    • Password: SAS token

    Any deviation in these parameters can lead to authentication failure after TLS handshake.

    5. Network and Access Validation

    Confirm there are no firewall or private endpoint restrictions blocking the device

    Ensure outbound connectivity to Azure IoT endpoints is allowed

    6. Enable Diagnostic Logging

    • Enable verbose logging on your gateway or SDK
    • Check for MQTT connection response codes (e.g., 401 Unauthorized, invalid token)
    • Review device-level diagnostics in IoT Central if available

    7. Isolate Using a Known Working Tool

    As a validation step Attempt to connect using a tool such as IoT Explorer with the same device credentials

    If successful, this confirms the issue is with SAS token generation or device-side configuration

    Since TLS connectivity is successful, the issue is most likely related to:

    • Incorrect SAS token generation
    • Device time synchronization issues
    • Incorrect MQTT configuration

    Please refer this

    Troubleshoot connection failures → https://docs.microsoft.com/azure/iot-central/core/troubleshoot-connection • Control access with SAS → https://docs.microsoft.com/azure/iot-hub/iot-hub-dev-guide-sas

    I hope this will help you. Please feel free to let me know if you have any other queries.

    Thank you!

    Was this answer helpful?

  3. Vinodh247-1375 44,716 Reputation points Volunteer Moderator
    2026-04-21T15:58:13.17+00:00

    Your issue is not connectivity (TLS is working), it is authentication failure with SAS token against Azure IoT Central.

    In IoT Central, SAS authentication only works if all three match exactly:

    1. Device ID used in code = device created in IoT Central

    SAS token format is correct (resource URI must be lowercase and include {scope-id}/devices/{device-id})

    Symmetric key used to generate the token is the device key (not group key, unless derived properly)

    Most common root cause in your case: the resource URI or expiry format is wrong, or you are using the group symmetric key directly instead of deriving the device key.

    Correct pattern:

    Host: <scope-id>.azure-devices-provisioning.net (for DPS) OR IoT Hub host assigned after provisioning

    Username: <scope-id>/registrations/<device-id>/api-version=2019-03-31 (DPS)

    SAS token: SharedAccessSignature sr=<resource-uri>&sig=<signature>&se=<expiry>

    If you are directly connecting (no DPS), then:

    Resource URI = <iot-hub-host>/devices/<device-id> (must be lowercase)

    your gateway is reaching azure, but SAS token generation (URI, key, or expiry) is incorrect. Fix that, and the connection will succeed.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.