Azure Internet of Things built-in role

Azure Device Registry Onboarding

Provisions and removes Azure Device Registry namespaces, linked IoT Hub and Device Provisioning Service resources, credential policies, and DPS enrollments for the documented X.509 certificate-management setup. It combines broad control-plane Actions with DPS enrollment DataActions.

Control-plane actions (8)

• Microsoft.DeviceRegistry/namespaces/read
• Microsoft.DeviceRegistry/namespaces/write
• Microsoft.DeviceRegistry/namespaces/delete
• Microsoft.DeviceRegistry/namespaces/credentials/*
• Microsoft.DeviceRegistry/namespaces/credentials/policies/*
• Microsoft.Devices/iothubs/*
• Microsoft.Devices/provisioningServices/*
• microsoft.deviceregistry/namespaces/devices/revoke/action

Data-plane actions (2)

• Microsoft.Devices/provisioningServices/enrollments/*
• Microsoft.Devices/provisioningServices/enrollmentGroups/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Use the resource group that contains the new IoT Hub, Device Registry namespace, and DPS instance for the onboarding workflow. Subscription scope is broader than the documented deployment and affects additional IoT resources.

Common use cases (2)

• Deploy the public-preview IoT Hub and Azure Device Registry integration with Microsoft-backed X.509 certificate management.
• Create or remove the Device Registry namespace, IoT Hub, DPS, credential policies, and DPS enrollments that form the integrated onboarding topology.

Prerequisites (2)

• An active subscription, a supported deployment region, and permission to create role assignments at the target resource-group scope are required.
• Plan whether certificate management is enabled; that option requires IoT Hub, Device Registry, DPS, and a user-assigned managed identity.

Best practices (2)

• Grant the role only for the deployment or deboarding window, validate the integrated resources, then replace it with the narrower runtime role required by the managed identity.
• Do not use the public-preview integration for production workloads until its preview limitations are acceptable and tested.

Security considerations (2)

• The role can create, change, and delete the namespace and linked IoT Hub and DPS resources and can mutate enrollment data used for device authentication.
• Deleting the linked IoT Hub is required before deleting the Device Registry namespace, and an overly broad assignment exposes additional IoT resources to destructive onboarding operations.

Assignment guidance

Assign Azure Device Registry Onboarding at the resource group containing the planned integration to the deployment identity for a time-bounded setup or deboarding operation. After validation, remove it and grant Azure Device Registry Contributor to the runtime managed identity on the namespace.

Related roles (1)

• Azure Device Registry Contributor: Provides the narrower documented runtime device access assigned to the integration managed identity after onboarding.

Editorial sources (6)

• Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Deploy Azure IoT Hub with Device Registry integration and certificate management (preview) →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →