Skip to content

Commit 70d82c6

Browse files
gsteve88gsteve88
committed
Added Entra how to connect service for .NET
1 parent 28b12df commit 70d82c6

File tree

2 files changed

+57
-26
lines changed

2 files changed

+57
-26
lines changed

‎includes/iot-hub-howto-connect-service-iothub-entra-dotnet.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
title: How to connect a service to IoT Hub using Microsoft Entra (.NET)
3+
titleSuffix: Azure IoT Hub
4+
description: Learn how to connect a service to IoT Hub using Microsoft Entra and the Azure IoT Hub SDK for .NET.
5+
author: kgremban
6+
ms.author: kgremban
7+
ms.service: iot-hub
8+
ms.devlang: csharp
9+
ms.topic: include
10+
ms.manager: lizross
11+
ms.date: 11/06/2024
12+
ms.custom: mqtt, devx-track-csharp, devx-track-dotnet
13+
---
14+
15+
Use [DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential) to use Microsoft Entra to authenticate a connection to IoT Hub. `DefaultAzureCredential` supports different authentication mechanisms and determines the appropriate credential type based of the environment it is executing in. It attempts to use multiple credential types in an order until it finds a working credential. For more information on setting up Entra for IoT Hub, see [Control access to IoT Hub by using Microsoft Entra ID](/azure/iot-hub/authenticate-authorize-azure-ad).
16+
17+
To create required Entra app parameters to `DefaultAzureCredential`, create an Entra app registration that contains the Azure client secret, client ID, and tenant ID. For more information, see [](/entra/identity-platform/quickstart-register-app).
18+
19+
Entra apps require permissions depending on operations performed:
20+
21+
* Add [IoT Hub Twin Contributor](/azure/role-based-access-control/built-in-roles/internet-of-things#iot-hub-twin-contributor) to enable read and write access to all IoT Hub device and module twins.
22+
23+
In this example, the Entra app registration client secret, client ID, and tenant ID are added to environment variables. These environment variables are used by `DefaultAzureCredential` to authenticate the application.
24+
25+
```csharp
26+
string clientSecretValue = "xxxxxxxxxxxxxxx";
27+
string clientID = "xxxxxxxxxxxxxx";
28+
string tenantID = "xxxxxxxxxxxxx";
29+
30+
Environment.SetEnvironmentVariable("AZURE_CLIENT_SECRET", clientSecretValue);
31+
Environment.SetEnvironmentVariable("AZURE_CLIENT_ID", clientID);
32+
Environment.SetEnvironmentVariable("AZURE_TENANT_ID", tenantID);
33+
34+
TokenCredential tokenCredential = new DefaultAzureCredential();
35+
```
36+
37+
The resulting [TokenCredential](/dotnet/api/azure.core.tokencredential) can then be passed to an authentication method for any SDK client that accepts Microsft Entra/AAD credentials:
38+
39+
* [JobClient](/dotnet/api/microsoft.azure.devices.jobclient.create?#microsoft-azure-devices-jobclient-create(system-string-azure-core-tokencredential-microsoft-azure-devices-httptransportsettings))
40+
* [RegistryManager](/dotnet/api/microsoft.azure.devices.registrymanager.create?#microsoft-azure-devices-registrymanager-create(system-string-azure-core-tokencredential-microsoft-azure-devices-httptransportsettings))
41+
* [DigitalTwinClient](/dotnet/api/microsoft.azure.devices.digitaltwinclient)
42+
* [ServiceClient]((/dotnet/api/microsoft.azure.devices.serviceclient.create?#microsoft-azure-devices-serviceclient-create(system-string-azure-core-tokencredential-microsoft-azure-devices-transporttype-microsoft-azure-devices-serviceclienttransportsettings-microsoft-azure-devices-serviceclientoptions)))
43+
44+
In this example, the `TokenCredential` is passed to `ServiceClient.Create` to create a [ServiceClient](/dotnet/api/microsoft.azure.devices.serviceclient) connection object.
45+
46+
```csharp
47+
string hostname = "xxxxxxxxxx.azure-devices.net";
48+
using var serviceClient = ServiceClient.Create(hostname, tokenCredential, TransportType.Amqp);
49+
```
50+
51+
In this example, the `TokenCredential` is passed to `RegistryManager.Create` to create a [RegistryManager](/dotnet/api/microsoft.azure.devices.registrymanager) object.
52+
53+
```csharp
54+
string hostname = "xxxxxxxxxx.azure-devices.net";
55+
registryManager = RegistryManager.Create(hostname, tokenCredential);
56+
```

‎includes/iot-hub-howto-module-twins-dotnet.md

Lines changed: 1 addition & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -175,32 +175,7 @@ registryManager = RegistryManager.CreateFromConnectionString(connectionString);
175175

176176
#### Connect using Microsoft Entra
177177

178-
Use [DefaultAzureCredential](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential) to use Microsoft Entra to authenticate a connection to IoT Hub. `DefaultAzureCredential` supports different authentication mechanisms and determines the appropriate credential type based of the environment it is executing in. It attempts to use multiple credential types in an order until it finds a working credential. For more information on setting up Entra for IoT Hub, see [Control access to IoT Hub by using Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/iot-hub/authenticate-authorize-azure-ad).
179-
180-
To supply parameters to `DefaultAzureCredential`, first create an Entra app registration that contains the Azure client secret, client ID, and tenant ID. An Entra profile requires [IoT Hub Twin Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/internet-of-things#iot-hub-twin-contributor) to enable read and write access to all IoT Hub device and module twins.
181-
182-
In this example, the Entra app registration client secret, client ID, and tenant ID are added to environment variables. These environment variables are used by `DefaultAzureCredential` to authenticate the application.
183-
184-
```csharp
185-
string clientSecretValue = "xxxxxxxxxxxxxxx";
186-
string clientID = "xxxxxxxxxxxxxx";
187-
string tenantID = "xxxxxxxxxxxxx";
188-
189-
Environment.SetEnvironmentVariable("AZURE_CLIENT_SECRET", clientSecretValue);
190-
Environment.SetEnvironmentVariable("AZURE_CLIENT_ID", clientID);
191-
Environment.SetEnvironmentVariable("AZURE_TENANT_ID", tenantID);
192-
193-
TokenCredential tokenCredential = new DefaultAzureCredential();
194-
```
195-
196-
The [TokenCredential](/dotnet/api/azure.core.tokencredential) can then be passed to [ServiceClient.Create](https://review.learn.microsoft.com/en-us/dotnet/api/microsoft.azure.devices.serviceclient.create?#microsoft-azure-devices-serviceclient-create(system-string-azure-core-tokencredential-microsoft-azure-devices-transporttype-microsoft-azure-devices-serviceclienttransportsettings-microsoft-azure-devices-serviceclientoptions)) to create a [ServiceClient](/dotnet/api/microsoft.azure.devices.serviceclient) connection object.
197-
198-
For example:
199-
200-
```csharp
201-
string hostname = "xxxxxxxxxx.azure-devices.net";
202-
using var serviceClient = ServiceClient.Create(hostname, tokenCredential, TransportType.Amqp);
203-
```
178+
[!INCLUDE [iot-hub-howto-connect-service-iothub-entra-dotnet](iot-hub-howto-connect-service-iothub-entra-dotnet.md)]
204179

205180
### Read and update module identity fields
206181

0 commit comments

Comments
 (0)