Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure IoT Hub provides a central message hub for bidirectional communication between IoT applications and the devices they manage. When deploying this service, it's important to follow security best practices to protect data, configurations, and infrastructure.
This article provides guidance on how to best secure your Azure IoT Hub deployment. If you're also using other Azure IoT services, see Secure your IoT solutions.
The security recommendations in this article implement Zero Trust principles: "Verify explicitly", "Use least privilege access", and "Assume breach". For comprehensive Zero Trust guidance, see the Zero Trust Guidance Center.
Device security
Securing the devices that connect to your IoT Hub is critical for the overall security of your IoT solution.
Use renewable device credentials: Implement a process for regularly updating device credentials, such as rolling X.509 certificates, to limit the impact of compromised authentication. For more information, see How to roll X.509 device certificates.
Deploy update agents on devices: Ensure devices have update agents for receiving and applying security updates, keeping firmware and software secure throughout the device lifecycle. For more information, see Device Update for IoT Hub.
Implement secure device provisioning: Use Azure IoT Hub Device Provisioning Service (DPS) for secure, zero-touch provisioning of devices at scale with appropriate authentication mechanisms. For more information, see IoT Hub Device Provisioning Service.
Use Trusted Platform Modules: Deploy devices with hardware-based security features like Trusted Platform Modules (TPMs) to provide secure storage for cryptographic keys and protect against physical tampering. For more information, see TPM attestation.
Revoke access for compromised devices: Implement procedures to quickly revoke access for devices that show signs of compromise, preventing them from connecting to your IoT Hub and potentially impacting other devices. For more information, see How to revoke device access.
Network security
Securing network access to your IoT Hub is crucial to prevent unauthorized access and protect the data flowing between your devices and the cloud.
Enable private endpoints: Eliminate public internet exposure by routing traffic through your virtual network with Azure Private Link, and allow devices to connect to your IoT hub without exposure to the public internet. For more information, see IoT Hub support for virtual networks with Azure Private Link.
Disable public network access: Prevent direct access from the public internet by disabling public endpoints when you can use private endpoints instead. For more information, see Managing public network access for your IoT hub.
Configure IP filtering: Restrict connections to your IoT Hub by allowing only specific IP addresses or ranges, and limit exposure to potential attacks. For more information, see IoT Hub IP filtering.
Enforce TLS 1.2 and strong cipher suites: Strengthen connection security by enforcing the use of TLS 1.2 and recommended cipher suites for all device and service connections. For more information, see Transport Layer Security (TLS) support in IoT Hub.
Identity and access management
Proper identity and access management is essential for controlling who can administer your IoT Hub and how devices authenticate to it.
Use Microsoft Entra ID authentication: Implement Microsoft Entra ID (formerly Azure AD) for authenticating and authorizing service API requests, and enable more granular access control than shared access policies. For more information, see Control access to IoT Hub by using Microsoft Entra ID.
Implement Azure RBAC for granular permissions: Assign least-privilege role-based access control to users and applications accessing IoT Hub management APIs, and reduce the risk of unauthorized operations. For more information, see Manage access to IoT Hub by using Azure RBAC role assignment.
Use X.509 certificates for device authentication: Implement X.509 certificate-based authentication instead of SAS tokens for production environments to increase security and enable better credential management. For more information, see Authenticate identities with X.509 certificates.
Avoid shared symmetric keys across devices: Assign unique credentials to each device to prevent widespread compromise if a single key is leaked, and limit the impact of potential credential exposure. For more information, see Security practices for device manufacturers.
Disable shared access policies when not needed: Reduce the attack surface by disabling shared access policies and tokens when using Microsoft Entra ID for authentication. For more information, see Enforce Microsoft Entra authentication.
Data protection
Protecting data both in transit and at rest is vital for maintaining the confidentiality and integrity of your IoT solution.
Use hardware security modules for device secrets: Store device certificates and private keys in hardware security modules (HSMs) to protect against extraction and tampering. This practice enhances the security of authentication credentials. For more information, see Hardware security module.
Implement device-level data encryption: Encrypt sensitive data on devices before transmission to IoT Hub to add a layer of protection beyond TLS, particularly for highly sensitive information. Also ensure that data stored in stateful components such as device twins is protected. For more information, see Security architecture for IoT solutions.
Use the latest SDK versions: Use the most recent IoT Hub device SDKs, which implement various security features including encryption and authentication. For more information, see Azure IoT SDKs.
Keep root CA certificates updated: Regularly update the trusted root certificates on your devices to maintain secure TLS connections. This practice helps you avoid connection failures due to expired or revoked certificates. For more information, see IoT Hub TLS support.
Logging and monitoring
Comprehensive logging and monitoring is essential for detecting and responding to potential security issues in your IoT solution.
Enable resource logs for connections and device telemetry: Configure diagnostic settings to send IoT Hub resource logs to Azure Monitor Logs. This configuration helps you track connection attempts, errors, and operations for security investigation. For more information, see Monitor and diagnose problems in your IoT hub.
Set up alerts for connectivity issues: Create alerts based on metrics and logs to detect unusual patterns like repeated authentication failures or unexpected disconnections that might indicate security problems. For more information, see Monitor, diagnose, and troubleshoot Azure IoT Hub device connectivity.
Enable Microsoft Defender for IoT: Activate Microsoft Defender for IoT on your IoT Hub to gain real-time security monitoring, recommendations, and alerts for potential threats targeting your IoT solution. For more information, see Quickstart: Enable Microsoft Defender for IoT on your Azure IoT Hub.
Compliance and governance
Establishing proper governance and ensuring compliance with security standards are key aspects of maintaining a secure IoT solution.
Apply Azure Policy for IoT Hub: Implement Azure Policy to enforce and audit security configurations across your IoT hubs, ensuring consistent security standards are maintained. For more information, see Azure Policy built-in definitions for Azure IoT Hub.
Regularly audit access permissions: Review and validate the IoT Hub shared access policies and Microsoft Entra ID role assignments granted to users, applications, and devices to ensure they adhere to the principle of least privilege. For more information, see Control access to IoT Hub by using Microsoft Entra ID.
Retain audit logs for compliance: Route IoT Hub resource logs and audit events to a Log Analytics workspace or storage account with a retention period that satisfies your compliance requirements, preserving records for security investigations and regulatory audits. For more information, see Monitor and diagnose problems in your IoT hub.
Backup and recovery
Planning for regional outages helps you maintain the availability and integrity of your IoT solution during disruptions.
- Plan for regional failover: Use IoT Hub manual failover to recover your hub's operations to its Azure geo-paired region during a regional outage, and validate your recovery process on a regular basis. For more information, see Perform manual failover for an IoT hub.