Does Azure IoT Operations OPC UA connector support Reverse Connect?

Isac Börjesson 20 Reputation points
2026-06-30T06:41:45.6933333+00:00

Hi,

I’m evaluating Azure IoT Operations for an OT-to-IT integration scenario and need to confirm whether the OPC UA connector supports OPC UA Reverse Connect.

Our requirement is that all traffic must be initiated outbound from OT. We cannot allow inbound connections from IT into OT. Since our OT systems expose OPC UA servers, we need the client side to support Reverse Connect / ReverseHello so the OPC UA server can initiate the connection.

I couldn’t find any mention of Reverse Connect support in the AIO OPC UA connector documentation.

Can you confirm:

  1. Does the AIO OPC UA connector support Reverse Connect today?
  2. If not, is it planned or under consideration?
  3. If not supported, is there a recommended architecture for outbound-only OT environments?

Thanks.

Azure IoT Operations
Azure IoT Operations

Azure IoT Operations is a set of modular services enabled by Azure Arc.

0 comments
Answer accepted by question author
Alex Burlachenko 25,120 Reputation points MVP Volunteer Moderator
2026-06-30T09:43:12.26+00:00

hi & thx for sharing urs issue here at Q&A portal,

I don’t see Reverse Connect listed as a supported feature for the Azure IoT Operations OPC UA connector today. The docs describe the connector as a client app running in the AIO cluster that connects to OPC UA servers. That means the normal model is still client-to-server connectivity from AIO toward the OPC UA server, not OPC UA server initiating ReverseHello back to the client.

OPC UA ReverseHello concept https://reference.opcfoundation.org/specs/OPC-10000-6/7.1.2.6

For outbound-only OT, the usual architecture is to place the AIO cluster or gateway component inside/near the OT network, so the connector initiates outbound traffic to Azure/MQTT/cloud, while OPC UA access stays local inside OT. If AIO must sit on the IT side and OT allows no inbound path at all, then u’d need a connector/client that explicitly supports OPC UA Reverse Connect, or an OT-side broker/gateway that republishes data outbound.

I’d treat Reverse Connect as not supported unless MS confirms otherwise. Ask product support for roadmap info, but don’t design around it being available today.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

 

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. SRILAKSHMI C 19,730 Reputation points Microsoft External Staff Moderator
    2026-06-30T10:19:16.4733333+00:00

    Hello @Isac Börjesson

    Thank you for Reaching out to Microsoft Q&A.

    From what you've described, your requirement is to ensure that all network communication is initiated from the OT network. In other words, your OPC UA servers should initiate the connection (using the OPC UA Reverse Connect/ReverseHello mechanism), and no inbound connections from the IT side into the OT network should be required.

    After reviewing the current Azure IoT Operations documentation, there is no indication that the Azure IoT Operations OPC UA connector supports OPC UA Reverse Connect (ReverseHello).

    The documentation describes the connector as an OPC UA client that establishes connections to OPC UA servers, browses their address space, creates sessions, monitors data changes, and writes values back to the servers. It also documents features such as authentication methods, certificate management, automatic reconnection, shared endpoint mode, and multiple server connections. However, Reverse Connect/ReverseHello is not listed as a supported capability.

    Based on the currently available documentation:

    Does the Azure IoT Operations OPC UA connector support Reverse Connect today?

    There is no documented support for OPC UA Reverse Connect (ReverseHello).

    Is it planned or under consideration?

    At this time, there is no public Microsoft documentation or roadmap confirming that Reverse Connect support is planned or under development.

    What is the recommended architecture for outbound-only OT environments?

    The connector is designed to operate as an OPC UA client that initiates connections to OPC UA servers. If your environment requires strict outbound-only communication from OT, you may need to consider an architecture that includes an intermediary component (such as an industrial gateway or another OPC UA client within the OT network) that establishes outbound connectivity while communicating with Azure IoT Operations using supported protocols. Since the current documentation does not provide an officially recommended architecture for Reverse Connect scenarios, the exact design will depend on your network and security requirements.

    If Reverse Connect support is a mandatory requirement for your deployment, we recommend opening a feature request through the appropriate Microsoft feedback channels so the product team can review your scenario and provide guidance on future support or alternative architectures.

    For more information, please refer to the Microsoft documentation:

    I Hope this helps. Do let me know if you have any further queries.

    Thank you!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.