Merge pull request #303782 from SoniaLopezBravo/patch-6

Update iot-hub-tls-support.md

Author: prmerger-automator[bot]

articles/iot-hub/iot-hub-tls-support.md

@@ -29,7 +29,7 @@ IoT Hub uses Transport Layer Security (TLS) to secure connections from IoT devic
 > - US Gov Arizona 
 > - US Gov Virginia (TLS 1.0/1.1 support isn't available in this region. TLS 1.2 enforcement must be enabled or IoT Hub creation fails). 
 >
-> To find out the version of TLS your IoT Hub devices are running, refer to [TLS 1.0 and 1.1 end of support guide](#checking-tls-versions-for-iot-hub-devices).
+> To find out the version of TLS your IoT Hub devices are running, refer to [TLS 1.0 and 1.1 end of support guide](#checking-tls-versions-and-cipher-suites-for-iot-hub-devices).
 
 ## Mutual TLS support
 
@@ -58,7 +58,7 @@ Root CA migrations are rare. You should always prepare your IoT solution for the
 
 Starting **August 31, 2025**, IoT Hub enforces the use of recommended strong cipher suites for all existing and new IoT Hubs. Non-recommended (weak) cipher suites aren't supported past this date.  
 
-To comply with Azure security policy for a secure connection, IoT Hub only supports the following RSA and ECDSA cipher suites that require minimum TLS 1.2 enforcement:
+To comply with Azure security policy for a secure connection, IoT Hub only supports the following RSA and ECDSA cipher suites:
 
 * TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 * TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
@@ -69,7 +69,7 @@ To comply with Azure security policy for a secure connection, IoT Hub only suppo
 * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 
-The following non-recommended cipher suites are allowed until August 31, 2025: 
+The following non-recommended cipher suites are allowed on hubs **without minTlsVersion:1.2** until August 31, 2025: 
 
 * TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
 * TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
@@ -154,32 +154,29 @@ The created IoT hub resource using this configuration refuses device and service
 > [!NOTE] 
 > Upon failover, the `minTlsVersion` property of your IoT Hub remains effective in the geo-paired region post-failover.
 
-## Checking TLS versions for IoT Hub devices
+## Checking TLS versions and cipher suites for IoT Hub devices
 
-Azure IoT Hub provides the capability to check the TLS version and other device connection metrics to help monitor the security of IoT devices. You can either use IoT Hub metrics or diagnostic logs to track TLS version usage and other related properties like [Cipher Suites](#cipher-suites).
+Azure IoT Hub provides the capability to check the TLS version, cipher suites, and other device connection metrics to help monitor the security of IoT devices. You can either use IoT Hub metrics or diagnostic logs to track TLS version usage and other related properties like [Cipher Suites](#cipher-suites).
 
-### Checking TLS versions using IoT Hub metrics
+### Checking TLS versions and cipher suites using IoT Hub metrics
 
-If you want to validate that device traffic to IoT Hub is utilizing TLSv1.2, you can check IoT Hub’s metrics. This allows you to filter by TLS version or Cipher Suite and check the number of successful connections. 
+If you want to validate that device traffic to IoT Hub is utilizing TLSv1.2 and strong cipher suites, you can check IoT Hub’s metrics. This allows you to filter by TLS version or cipher suite and check the number of successful connections. 
 
 1. In the [Azure portal](https://portal.azure.com), go to your IoT hub.
 1. In the left-side menu under **Monitoring**,  select **Metrics**.
 1. Add the metric **Successful Connects**.
 
     :::image type="content" source="./media/iot-hub-tls-support/tls-versions-support-metrics.png" alt-text="Screenshot showing how to add the Successful Connects metric.":::
 
-1. Filter by TLS Version or Cipher Suite by selecting the **Add filter** button and choosing the appropriate property, TLS Version or Cipher Suite, operator, for example "=", and value, for example, TLSv1.2.
+1. Filter by TLS Version or cipher suite by selecting the **Add filter** button and choosing the appropriate property, TLS Version or cipher suite, operator, for example "=", and value, for example, TLSv1.2.
 
     :::image type="content" source="./media/iot-hub-tls-support/tls-versions-support-metrics-filter.png" alt-text="Screenshot showing how to filter by TLS Version or Cipher Suite.":::
 
 1. After applying the filter, you see the sum of devices with successful IoT Hub connections based on the filtered property and value(s).  
 
-> [!NOTE]
-> TLS version query isn't available for devices using HTTPS connections.
-
-### Checking TLS versions using IoT Hub diagnostic logs
+### Checking TLS versions and cipher suites using IoT Hub diagnostic logs
 
-Azure IoT Hub can provide diagnostic logs for several categories that can be analyzed using Azure Monitor Logs. In the connections log you can find the TLS version for your IoT Hub devices. 
+Azure IoT Hub can provide diagnostic logs for several categories that can be analyzed using Azure Monitor Logs. In the connections log you can find the TLS version and cipher suite for your IoT Hub devices. 
 
 To view these logs, follow these steps: