Provision devices to cloud platforms
The cloud platform policy in DigiCert® Device Trust Manager defines the configuration required to automatically onboard and offboard devices to and from the OEM's preferred IoT platform, such as Azure Event Grid and Azure IoT Device.
OEMs often leverage public IoT platforms not only for device connectivity but also for hosting microservices, managing telemetry, and operating cloud-native infrastructure, such as databases and Kubernetes workloads. These platforms form the backbone of the OEM’s connected product ecosystem.
The cloud platform policy ensures that:
Devices provisioned through Device Trust Manager are automatically registered with the target IoT platform.
Devices can seamlessly authenticate and connect to the IoT platform endpoint.
Devices are automatically offboarded from the IoT platform when deleted in Device Trust Manager.
Cloud platform policies are assigned to Device groups in Device Trust Manager. Each cloud platform policy assignment to the group leverages the corresponding certificate management policy, specifically one that is used for operational certificates. This ensures that the device is provisioned with an appropriate X.509 certificate, enabling secure authentication with the IoT platform during its operational lifecycle.
Choose a cloud platform
Device Trust Manager supports cloud platform policies for Azure Event Grid MQTT broker and Azure IoT Device Provisioning Service.
Choose the cloud platform that matches how you want to connect, provision, and manage your devices in Azure:
Azure Event Grid MQTT broker:
Azure Event Grid provides a fully managed MQTT broker that enables devices and applications to exchange messages by using the MQTT publish-and-subscribe protocol. It supports event-driven IoT solutions in which devices send telemetry and receive commands or other messages.
Through a cloud platform policy, Device Trust Manager automatically registers devices with the configured Azure Event Grid namespace. After registration, devices use X.509 certificates to authenticate and connect securely to the MQTT broker.
Azure IoT Device Provisioning Service:
Azure IoT Hub Device Provisioning Service (DPS) is a helper service for Azure IoT Hub that enables zero-touch, just-in-time device provisioning. DPS verifies a device identity, registers the device with an appropriate IoT hub, and returns the information the device needs to connect to that hub.
Through a cloud platform policy, Device Trust Manager provisions devices to Azure IoT Hub through DPS. After provisioning, devices use the assigned IoT Hub connection information to connect securely and communicate directly with the hub.
Comparison | Azure Event Grid MQTT broker | Azure IoT Device Provisioning Service |
|---|---|---|
What it is | A managed MQTT broker that enables devices and applications to publish and subscribe to messages through an Azure Event Grid namespace. | A provisioning service that registers devices with Azure IoT Hub and provides each device with its assigned IoT Hub connection information. |
Why use it | Use it to establish secure MQTT communication between devices, cloud applications, and backend services. | Use it to automate the registration and assignment of devices to one or more Azure IoT hubs. |
Approach | Device Trust Manager registers the device identity with the configured Event Grid namespace. The device then uses its certificate and broker connection information to establish an MQTT connection and exchange messages. | A device contacts Azure IoT Device Provisioning Service during onboarding. Azure IoT Device Provisioning Service verifies the device identity, selects a linked IoT hub according to the allocation policy, registers the device, and returns the assigned hub information. |
Key benefits | Managed MQTT messaging, certificate-based client authentication, granular publish and subscribe permissions, and centralized management of device identities and certificates. | Zero-touch provisioning, large-scale device registration, flexible assignment across IoT hubs, identity verification, and support for initial device configuration. |
Authentication or attestation methods | While Azure Event Grid supports several authentication methods, Device Trust Manager currently supports CA-signed X.509 certificate authentication. | While Azure IoT Device Provisioning Service several attestation methods, Device Trust Manager currently supports CA-signed X.509 certificate attestation. |
When to use | Use it when devices or applications must exchange telemetry, commands, or other messages through MQTT. | Use it when devices must be registered with Azure IoT Hub and discover their assigned IoT hub during provisioning. |
What's next?
After choosing a cloud platform, create the corresponding cloud platform policy:
If you're using Azure Event Grid MQTT Broker, see Create an Azure Event Grid MQTT broker cloud platform policy
If you're using Azure IoT DPS, see Create an Azure IoT DPS cloud platform policy