Merge pull request #217037 from eshashah-msft/master

Updating the resource creation and configuration

Author: v-dirichards

articles/iot-hub-device-update/device-update-resources.md

@@ -3,7 +3,7 @@ title: Understand Device Update for Azure IoT Hub resources | Microsoft Docs
 description: Understand Device Update for Azure IoT Hub resources
 author: vimeht
 ms.author: vimeht
-ms.date: 06/14/2022
+ms.date: 11/02/2022
 ms.topic: conceptual
 ms.service: iot-hub-device-update
 ---
@@ -27,7 +27,7 @@ During public preview, two Device update accounts can be created per subscriptio
 
 ## Configure the linked IoT hub
 
-In order for Device Update to receive change notifications from IoT Hub, Device Update integrates with the built-in Event Hubs. Clicking the "Configure IoT Hub" button within your instance configures the required message routes, consumer groups, and access policy required to communicate with IoT devices.
+In order for Device Update to receive change notifications from IoT Hub, Device Update integrates with the built-in Event Hubs. The IoT Hub will be configured automatically as part of the resource creation process with the required message routes, consumer groups, and access policy required to communicate with IoT devices.
 
 ### Message Routing
 
@@ -45,19 +45,21 @@ The following Message Routes are automatically configured in your linked IoT hub
 
 ### Consumer group
 
-Configuring the IoT hub also creates an event hub consumer group called **adum** that is required by the Device Update management services.
+ The IoT hub also creates an event hub consumer group called **adum** that is required by the Device Update management services. This should be added automatically as part of the resource creation process. 
 
 :::image type="content" source="media/device-update-resources/consumer-group.png" alt-text="Screenshot of consumer groups." lightbox="media/device-update-resources/consumer-group.png":::
 
-### Access policy
+### Configuring access for Azure Device Update service principal in the IoT Hub
 
-A shared access policy named **deviceupdateservice** is used by the Device Update Management services to query for update-capable devices. The **deviceupdateservice** policy is created and given the following permissions as part of configuring the IoT Hub:
+Device Update for IoT Hub communicates with the IoT Hub for deployments and manage updates at scale. In order to enable Device Update to do this, users need to set IoT Hub Data Contributor access for Azure Device Update Service Principal in the IoT Hub permissions. 
 
-- Registry read
-- Service connect
-- Device connect
+Deployment, device and update management and diagnostic actions will not be allowed if these permissions are not set. Operations that will be blocked will include:
+* Create Deployment
+* Cancel Deployment
+* Retry Deployment 
+* Get Device
 
-:::image type="content" source="media/device-update-resources/access-policy.png" alt-text="Screenshot of access policy." lightbox="media/device-update-resources/access-policy.png":::
+The permission can be set from IoT Hub Access Control (IAM). Refer to [Configure Access for Azure Device update service principal in linked IoT hub](configure-access-control-device-update.md#configure-access-for-azure-device-update-service-principal-in-linked-iot-hub)
 
 ## Next steps