Azure Internet of Things built-in role
Azure Device Registry Onboarding
Provisions and removes Azure Device Registry namespaces, linked IoT Hub and Device Provisioning Service resources, credential policies, and DPS enrollments for the documented X.509 certificate-management setup. It combines broad control-plane Actions with DPS enrollment DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 547f7f0a-69c0-4807-bd9e-0321dfb66a84
Control-plane actions (8)
Microsoft.DeviceRegistry/namespaces/readMicrosoft.DeviceRegistry/namespaces/writeMicrosoft.DeviceRegistry/namespaces/deleteMicrosoft.DeviceRegistry/namespaces/credentials/*Microsoft.DeviceRegistry/namespaces/credentials/policies/*Microsoft.Devices/iothubs/*Microsoft.Devices/provisioningServices/*microsoft.deviceregistry/namespaces/devices/revoke/action
Data-plane actions (2)
Microsoft.Devices/provisioningServices/enrollments/*Microsoft.Devices/provisioningServices/enrollmentGroups/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Use the resource group that contains the new IoT Hub, Device Registry namespace, and DPS instance for the onboarding workflow. Subscription scope is broader than the documented deployment and affects additional IoT resources.
Common use cases (2)
- Deploy the public-preview IoT Hub and Azure Device Registry integration with Microsoft-backed X.509 certificate management.
- Create or remove the Device Registry namespace, IoT Hub, DPS, credential policies, and DPS enrollments that form the integrated onboarding topology.
Prerequisites (2)
- An active subscription, a supported deployment region, and permission to create role assignments at the target resource-group scope are required.
- Plan whether certificate management is enabled; that option requires IoT Hub, Device Registry, DPS, and a user-assigned managed identity.
Best practices (2)
- Grant the role only for the deployment or deboarding window, validate the integrated resources, then replace it with the narrower runtime role required by the managed identity.
- Do not use the public-preview integration for production workloads until its preview limitations are acceptable and tested.
Security considerations (2)
- The role can create, change, and delete the namespace and linked IoT Hub and DPS resources and can mutate enrollment data used for device authentication.
- Deleting the linked IoT Hub is required before deleting the Device Registry namespace, and an overly broad assignment exposes additional IoT resources to destructive onboarding operations.
Assignment guidance
Assign Azure Device Registry Onboarding at the resource group containing the planned integration to the deployment identity for a time-bounded setup or deboarding operation. After validation, remove it and grant Azure Device Registry Contributor to the runtime managed identity on the namespace.
Related roles (1)
- Azure Device Registry Contributor: Provides the narrower documented runtime device access assigned to the integration managed identity after onboarding.
Common questions
When should I assign the Azure Device Registry Onboarding Azure role?
Assign Azure Device Registry Onboarding when you need to: Deploy the public-preview IoT Hub and Azure Device Registry integration with Microsoft-backed X.509 certificate management.; and Create or remove the Device Registry namespace, IoT Hub, DPS, credential policies, and DPS enrollments that form the integrated onboarding topology.. Practical scope: Use the resource group that contains the new IoT Hub, Device Registry namespace, and DPS instance for the onboarding workflow. Subscription scope is broader than the documented deployment and affects additional IoT resources.
What permissions does the Azure Device Registry Onboarding Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.DeviceRegistry/namespaces/read; Microsoft.DeviceRegistry/namespaces/write; Microsoft.DeviceRegistry/namespaces/delete; Microsoft.DeviceRegistry/namespaces/credentials/*; Microsoft.DeviceRegistry/namespaces/credentials/policies/*; and Microsoft.Devices/iothubs/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Device Registry Onboarding Azure role?
Key considerations when assigning Azure Device Registry Onboarding: The role can create, change, and delete the namespace and linked IoT Hub and DPS resources and can mutate enrollment data used for device authentication.; and Deleting the linked IoT Hub is required before deleting the Device Registry namespace, and an overly broad assignment exposes additional IoT resources to destructive onboarding operations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Internet of Things - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Deploy Azure IoT Hub with Device Registry integration and certificate management (preview) →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.