Skip to content

Commit db6a831

Browse files
miagdpmiagdp
committed
fix merge issues
1 parent beb9b59 commit db6a831

File tree

6 files changed

+99
-33
lines changed

6 files changed

+99
-33
lines changed

‎articles/active-directory/managed-identities-azure-resources/services-support-managed-identities.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,11 +218,11 @@ Refer to the following list to configure managed identity for Azure Functions (i
218218
Managed identity type | All Generally Available<br>Global Azure Regions | Azure Government | Azure Germany | Azure China 21Vianet |
219219
| --- | :-: | :-: | :-: | :-: |
220220
| System assigned | ![Available][check] | ![Available][check] | Not available | ![Available][check] |
221-
| User assigned | Not available | Not available | Not available | Not available |
221+
| User assigned | ![Available][check] | ![Available][check] | Not available | ![Available][check] |
222222

223223
Refer to the following list to configure managed identity for Azure IoT Hub (in regions where available):
224224

225-
- [Azure portal](../../iot-hub/virtual-network-support.md#turn-on-managed-identity-for-iot-hub)
225+
- For more information, please see [Azure IoT Hub support for managed identities](../../iot-hub/iot-hub-managed-identity.md).
226226

227227
### Azure Import/Export
228228

‎articles/iot-hub/iot-hub-bulk-identity-mgmt.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ while(true)
8282
```
8383

8484
> [!NOTE]
85-
> If your storage account has firewall configurations that restrict IoT Hub's connectivity, consider using [Microsoft trusted first party exception](./virtual-network-support.md#egress-connectivity-to-storage-account-endpoints-for-routing) (available in select regions for IoT hubs with managed service identity).
85+
> If your storage account has firewall configurations that restrict IoT Hub's connectivity, consider using [Microsoft trusted first party exception](./virtual-network-support.md#egress-connectivity-from-iot-hub-to-other-azure-resources) (available in select regions for IoT hubs with managed service identity).
8686
8787

8888
## Device import/export job limits

‎articles/iot-hub/iot-hub-devguide-messages-d2c.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ An IoT hub has a default built-in-endpoint (**messages/events**) that is compati
3131

3232
Each message is routed to all endpoints whose routing queries it matches. In other words, a message can be routed to multiple endpoints.
3333

34-
If your custom endpoint has firewall configurations, consider using the Microsoft trusted first party exception, to give your IoT Hub access to the specific endpoint - [Azure Storage](./virtual-network-support.md#egress-connectivity-to-storage-account-endpoints-for-routing), [Azure Event Hubs](./virtual-network-support.md#egress-connectivity-to-event-hubs-endpoints-for-routing) and [Azure Service Bus](./virtual-network-support.md#egress-connectivity-to-service-bus-endpoints-for-routing). This is available in select regions for IoT Hubs with [managed service identity](./virtual-network-support.md).
34+
If your custom endpoint has firewall configurations, consider using the [Microsoft trusted first party exception](./virtual-network-support.md#egress-connectivity-from-iot-hub-to-other-azure-resources)
3535

3636
IoT Hub currently supports the following endpoints:
3737

‎articles/iot-hub/iot-hub-managed-identity.md

Lines changed: 93 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,40 +13,108 @@ ms.author: miag
1313

1414
Managed identities provide Azure services with an automatically managed identity in Azure AD in a secure manner. This eliminates the needs for developers having to manage credentials by providing an identity. There are two types of managed identities: system-assigned and user-assigned. IoT Hub supports both.
1515

16-
In IoT Hub, managed identities can be used for egress connectivity from IoT Hub to other Azure services for features such as [message routing](iot-hub-devguide-messages-d2c), [file upload](iot-hub-devguide-file-upload), and [bulk device import/export](iot-hub-bulk-identity-mgmt). In this article, you learn how to use system-assigned and user-assigned managed identities in your IoT Hub for different functionalities.
16+
In IoT Hub, managed identities can be used for egress connectivity from IoT Hub to other Azure services for features such as [message routing](iot-hub-devguide-messages-d2c.md), [file upload](iot-hub-devguide-file-upload.md), and [bulk device import/export](iot-hub-bulk-identity-mgmt.md). In this article, you learn how to use system-assigned and user-assigned managed identities in your IoT Hub for different functionalities.
1717

1818

1919
## Prerequisites
20-
1. Read the documentation of [managed identities for Azure resources](./../active-directory/managed-identities-azure-resources/overview) to understand the differences between system-assigned and user-assigned managed identity.
20+
1. Read the documentation of [managed identities for Azure resources](./../active-directory/managed-identities-azure-resources/overview.md) to understand the differences between system-assigned and user-assigned managed identity.
2121

22-
2. If you don’t have an IoT Hub, [create an IoT Hub](iot-hub-create-through-portal) before continuing.
22+
2. If you don’t have an IoT Hub, [create an IoT Hub](iot-hub-create-through-portal.md) before continuing.
2323

2424

2525
## System-assigned managed identity
2626

27-
### Add and remove a system-assigned managed identity in Azure Portal
27+
### Add and remove a system-assigned managed identity in Azure portal
2828
1. Sign in to the Azure portal and navigate to your desired IoT Hub.
2929
2. Navigate to **Identity** in your IoT Hub portal
3030
3. Under **System-assigned** tab, select **On** and click **Save**.
3131
4. To remove system-assigned managed identity from an IoT Hub, select **Off** and click **Save**.
3232

33-
![IoT Hub system assigned](./media/iot-hub-managed-identity/system-assigned.png)
33+
:::image type="content" source="./media/iot-hub-managed-identity/system-assigned.png" alt-text="Screenshot showing where to turn on system-assigned managed identity for an IoT hub":::
3434

35+
### Enable managed identity at hub creation time using ARM template
3536

37+
To enable the system-assigned managed identity in your IoT hub at resource provisioning time, use the ARM template below. This ARM template has two required resources, and they both need to be deployed before creating other resources like `Microsoft.Devices/IotHubs/eventHubEndpoints/ConsumerGroups`.
38+
39+
```json
40+
{
41+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
42+
"contentVersion": "1.0.0.0",
43+
"resources": [
44+
{
45+
"type": "Microsoft.Devices/IotHubs",
46+
"apiVersion": "2020-03-01",
47+
"name": "<provide-a-valid-resource-name>",
48+
"location": "<any-of-supported-regions>",
49+
"identity": {
50+
"type": "SystemAssigned"
51+
},
52+
"sku": {
53+
"name": "<your-hubs-SKU-name>",
54+
"tier": "<your-hubs-SKU-tier>",
55+
"capacity": 1
56+
}
57+
},
58+
{
59+
"type": "Microsoft.Resources/deployments",
60+
"apiVersion": "2018-02-01",
61+
"name": "createIotHub",
62+
"dependsOn": [
63+
"[resourceId('Microsoft.Devices/IotHubs', '<provide-a-valid-resource-name>')]"
64+
],
65+
"properties": {
66+
"mode": "Incremental",
67+
"template": {
68+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
69+
"contentVersion": "0.9.0.0",
70+
"resources": [
71+
{
72+
"type": "Microsoft.Devices/IotHubs",
73+
"apiVersion": "2020-03-01",
74+
"name": "<provide-a-valid-resource-name>",
75+
"location": "<any-of-supported-regions>",
76+
"identity": {
77+
"type": "SystemAssigned"
78+
},
79+
"sku": {
80+
"name": "<your-hubs-SKU-name>",
81+
"tier": "<your-hubs-SKU-tier>",
82+
"capacity": 1
83+
}
84+
}
85+
]
86+
}
87+
}
88+
}
89+
]
90+
}
91+
```
92+
93+
After substituting the values for your resource `name`, `location`, `SKU.name` and `SKU.tier`, you can use Azure CLI to deploy the resource in an existing resource group using:
94+
95+
```azurecli-interactive
96+
az deployment group create --name <deployment-name> --resource-group <resource-group-name> --template-file <template-file.json>
97+
```
98+
99+
After the resource is created, you can retrieve the managed service identity assigned to your hub using Azure CLI:
100+
101+
```azurecli-interactive
102+
az resource show --resource-type Microsoft.Devices/IotHubs --name <iot-hub-resource-name> --resource-group <resource-group-name>
103+
```
36104
## User-assigned managed identity
37-
In this section, you learn how to add and remove a user-assigned managed identity from an IoT Hub using Azure Portal.
105+
In this section, you learn how to add and remove a user-assigned managed identity from an IoT Hub using Azure portal.
38106
1. First you need to create a user-assigned managed identity as a standalone resource. You can follow the instructions [here](./../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#create-a-user-assigned-managed-identity) to create a user-assigned managed identity.
39107
2. Go to your IoT Hub, navigate to the **Identity** in your IoT Hub portal.
40108
3. Under **User-Assigned** tab, click **Add user-assigned managed identity**. Choose the user-assigned managed identity you want to add to IoT Hub and then click **Select**.
41-
4. You can remove a user-assigned identity from an IoT Hub. Choose the user-assigned identity you want to remove, and click **Remove** button. Note you are only removing it from IoT Hub, and this does not delete the user-assigned identity as a resource. To delete the user-assigned identity as a resource, follow the instructions [here](./../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#delete-a-user-assigned-managed-identity).
109+
4. You can remove a user-assigned identity from an IoT Hub. Choose the user-assigned identity you want to remove, and click **Remove** button. Note you are only removing it from IoT Hub, and this removal does not delete the user-assigned identity as a resource. To delete the user-assigned identity as a resource, follow the instructions [here](./../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md#delete-a-user-assigned-managed-identity).
42110

43-
![IoT Hub user assigned](./media/iot-hub-managed-identity/user-assigned.png)
111+
:::image type="content" source="./media/iot-hub-managed-identity/user-assigned.png" alt-text="Screenshot showing how to add user-assigned managed identity for an IoT hub":::
44112

45113
## Egress connectivity from IoT Hub to other Azure resources
46-
In IoT Hub, managed identities can be used for egress connectivity from IoT Hub to other Azure services for [message routing](iot-hub-devguide-messages-d2c), [file upload](iot-hub-devguide-file-upload), and [bulk device import/export](iot-hub-bulk-identity-mgmt). You can choose which managed identity to use for each IoT Hub egress connectivity to customer-owned endpoints including storage accounts, event hubs and service bus endpoints.
114+
In IoT Hub, managed identities can be used for egress connectivity from IoT Hub to other Azure services for [message routing](iot-hub-devguide-messages-d2c.md), [file upload](iot-hub-devguide-file-upload.md), and [bulk device import/export](iot-hub-bulk-identity-mgmt.md). You can choose which managed identity to use for each IoT Hub egress connectivity to customer-owned endpoints including storage accounts, event hubs, and service bus endpoints.
47115

48116
### Message routing
49-
In this section we use the [message routing](iot-hub-devguide-messages-d2c) to event hub custom endpoint as an example. The same thing applies to other routing custom endpoints.
117+
In this section, we use the [message routing](iot-hub-devguide-messages-d2c.md) to event hub custom endpoint as an example. The same thing applies to other routing custom endpoints.
50118

51119
1. First we need to go to your event hub in Azure portal, to assign the managed identity the right access. In your event hub, navigate to the **Access control (IAM)** tab and click **Add** then **Add a role assignment**.
52120
3. Select **Event Hubs Data Sender as role**.
@@ -56,48 +124,51 @@ In this section we use the [message routing](iot-hub-devguide-messages-d2c) to e
56124
57125
4. For user-assigned, choose **User-assigned managed identity** under **Assign access to**. Select your subscription and your user-assigned managed identity in the drop-down list. Click the **Save** button.
58126

59-
![IoT Hub message routing with user assigned](./media/iot-hub-managed-identity/eventhub-iam-user-assigned.png)
127+
:::image type="content" source="./media/iot-hub-managed-identity/eventhub-iam-user-assigned.png" alt-text="IoT Hub message routing with user assigned":::
60128

61129
5. For system-assigned, under **Assign access to** choose **User, group, or service principal** and select your IoT Hub's resource name in the drop-down list. Click **Save**.
62130

63-
![IoT Hub message routing with system assigned](./media/iot-hub-managed-identity/eventhub-iam-system-assigned.png)
131+
:::image type="content" source="./media/iot-hub-managed-identity/eventhub-iam-system-assigned.png" alt-text="IoT Hub message routing with system assigned":::
64132

133+
If you need to restrict the connectivity to your custom endpoint through a VNet, you need to turn on the trusted Microsoft first party exception, to give your IoT Hub access to the specific endpoint. For example, if you're adding an event hub custom endpoint, navigate to the **Firewalls and virtual networks** tab in your event hub and enable **Allow access from selected networks** option. Under the **Exceptions** list, check the box for **Allow trusted Microsoft services to access event hubs**. Click the **Save** button. This also applies to storage account and service bus. Learn more about [IoT Hub support for virtual networks](./virtual-network-support.md).
65134

66135
> [!NOTE]
67136
> You need to complete above steps to assign the managed identity the right access before adding the event hub as a custom endpoint in IoT Hub. Please wait a few minutes for the role assignment to propagate.
68137
69-
6. Next, go to your IoT Hub. In your Hub, navigate to **Message Routing**, then click **Custom endpoints**. Click **Add** and choose the type of endpoint you would like to use. In this section, we use event hub as the example.
70-
7. At the bottom of the page, choose your preferred **Authentication type**. In this section we use the **User-Assigned** as the example. In the dropdown, select the preferred user-assigned managed identity then click **Create**.
138+
6. Next, go to your IoT Hub. In your Hub, navigate to **Message Routing**, then click **Custom endpoints**. Click **Add** and choose the type of endpoint you would like to use. In this section, we use event hub as the example.
139+
7. At the bottom of the page, choose your preferred **Authentication type**. In this section, we use the **User-Assigned** as the example. In the dropdown, select the preferred user-assigned managed identity then click **Create**.
71140

72-
![IoT Hub event hub with user assigned](./media/iot-hub-managed-identity/eventhub-routing-endpoint.png)
141+
:::image type="content" source="./media/iot-hub-managed-identity/eventhub-routing-endpoint.png" alt-text="IoT Hub event hub with user assigned":::
73142

74143
8. Custom endpoint successfully created.
75144
9. After creation, you can still change the authentication type. Select the custom endpoint that you want to change the authentication type, then click **Change authentication type**.
76145

77-
![IoT Hub authentication type](./media/iot-hub-managed-identity/change-authentication-type.png)
78-
146+
:::image type="content" source="./media/iot-hub-managed-identity/change-authentication-type.png" alt-text="IoT Hub authentication type":::
79147

80148
10. Choose the new authentication type to be updated for this endpoint, click **Save**.
81149

82150
### File Upload
83-
IoT Hub's [file upload](iot-hub-devguide-file-upload) feature allows devices to upload files to a customer-owned storage account. To allow the file upload to function, IoT Hub need to have connectivity to the storage account. Similar to message routing, you can pick the preferred authentication type and managed identity for IoT Hub egress connectivity to your Azure Storage account.
151+
IoT Hub's [file upload](iot-hub-devguide-file-upload.md) feature allows devices to upload files to a customer-owned storage account. To allow the file upload to function, IoT Hub needs to have connectivity to the storage account. Similar to message routing, you can pick the preferred authentication type and managed identity for IoT Hub egress connectivity to your Azure Storage account.
84152

85153
1. In the Azure portal, navigate to your storage account's **Access control (IAM)** tab and click **Add** under the **Add a role assignment** section.
86154
2. Select **Storage Blob Data Contributor** (not Contributor or Storage Account Contributor) as role.
87155
3. For user-assigned, choose **User-assigned managed identity** under Assign access to. Select your subscription and your user-assigned managed identity in the drop-down list. Click the **Save** button.
88156
4. For system-assigned, under **Assign access to** choose **User, group, or service principal** and select your IoT Hub's resource name in the drop-down list. Click **Save**.
89157

158+
If you need to restrict the connectivity to your storage account through a VNet, you need to turn on the trusted Microsoft first party exception, to give your IoT Hub access to the storage account. On your storage account resource page, navigate to the **Firewalls and virtual networks** tab and enable **Allow access from selected networks** option. Under the **Exceptions** list, check the box for **Allow trusted Microsoft services to access this storage account**. Click the **Save** button. Learn more about [IoT Hub support for virtual networks](./virtual-network-support.md).
159+
160+
90161
> [!NOTE]
91162
> You need to complete above steps to assign the managed identity the right access before saving the storage account in IoT Hub for file upload using the managed identity. Please wait a few minutes for the role assignment to propagate.
92163
93-
1. On your IoT Hub's resource page, navigate to **File upload** tab.
94-
1. On the page that shows up, select the container that you intend to use in your blob storage, configure the **File notification settings, SAS TTL, Default TTL, and Maximum delivery count** as desired. Choose the preferred authentication type, and click **Save**.
164+
5. On your IoT Hub's resource page, navigate to **File upload** tab.
165+
6. On the page that shows up, select the container that you intend to use in your blob storage, configure the **File notification settings, SAS TTL, Default TTL, and Maximum delivery count** as desired. Choose the preferred authentication type, and click **Save**.
95166

96-
![IoT Hub file upload with msi](./media/iot-hub-managed-identity/file-upload.png)
167+
:::image type="content" source="./media/iot-hub-managed-identity/file-upload.png" alt-text="IoT Hub file upload with msi":::
97168

98169
### Bulk device import/export
99170

100-
IoT Hub supports the functionality to [import/export devices](iot-hub-bulk-identity-mgmt)' information in bulk from/to a customer-provided storage blob. This functionality requires connectivity from IoT Hub to the storage account.
171+
IoT Hub supports the functionality to [import/export devices](iot-hub-bulk-identity-mgmt.md)' information in bulk from/to a customer-provided storage blob. This functionality requires connectivity from IoT Hub to the storage account.
101172

102173
1. In the Azure portal, navigate to your storage account's **Access control (IAM)** tab and click **Add** under the **Add a role assignment** section.
103174
2. Select **Storage Blob Data Contributor** (not Contributor or Storage Account Contributor) as role.

0 commit comments

Comments
 (0)