Announcing new security enhancements across Azure IoT services

Microsoft

Aug 10, 2026

Security is foundational to the connected products and solutions our customers build. It shapes every decision, from how devices are provisioned to how they connect and receive updates. As device fleets scale and attackers probe new vectors, from the network layer to the software supply chain, customers are asking for stronger security defaults at each of these stages.

Today we’re strengthening all three. Customers managing connected devices get a modern transport-security baseline with TLS 1.3 for Azure IoT Hub, identity-based provisioning that removes long-lived secrets with managed identity support for linking an IoT Hub to DPS, and encrypted update delivery with TLS downloads for Device Update for IoT Hub. TLS 1.3 and managed identity are in Public Preview; TLS downloads is Generally Available.

At a glance

Feature	Service	Status
TLS 1.3 support	Azure IoT Hub	Public Preview
Managed identity for Hub linking	Azure IoT Device Provisioning Service + IoT Hub	Public Preview
TLS downloads (encrypted update delivery)	Device Update for IoT Hub	Generally Available

TLS 1.3 support for Azure IoT Hub (Public Preview)

Azure IoT Hub now supports TLS 1.3 through new endpoints that sit alongside the existing classic endpoint:

Classic endpoint: <hub>.azure-devices.net

TLS 1.3 Device endpoint: <hub>.device.azure-devices.net

TLS 1.3 Service endpoint: <hub>.service.azure-devices.net

The new device and service endpoints support TLS 1.3, and also support TLS 1.2 with a reduced, security-compliant cipher suite set. Devices connect through the device endpoint for device-to-cloud telemetry and cloud-to-device messages, while backend and management applications built on the service SDK connect through the service endpoint.

The existing endpoint remains available, so customers can adopt the new endpoints on their own timeline rather than through a forced migration. No enablement action is needed: the new endpoints are provisioned automatically on new and existing hubs, and customers adopt TLS 1.3 by pointing their device or service clients at the new hostnames.

TLS 1.3 gives customers a more modern security baseline for IoT connectivity. Just as importantly, this release introduces a clearer separation between device traffic and service traffic through dedicated endpoints, which makes the connectivity model easier to understand and evolve over time.

This design also reflects how real IoT deployments work. Many customers cannot update every device or backend integration at once, so a side-by-side endpoint model helps teams test, validate, and roll out changes in stages.

Learn more about Azure IoT Hub support for TLS 1.3.

Managed identity support for Hub linking (Public Preview)

We are also introducing managed identity support for linking an IoT Hub to DPS. DPS links to an IoT Hub securely to assign devices to the right hubs at scale, and until now, that link has relied on connection-string (shared access key) authentication. This dependency on a shared key results in customers keeping local authentication enabled on the IoT Hub, even when their security policies call for disabling it in favor of Microsoft Entra ID.

Managed identity support removes that constraint: DPS can now authenticate to IoT Hub using a managed identity backed by Microsoft Entra ID so the Hub linking no longer requires a connection string. As a result, customers can disable local authentication on the IoT Hub, remove long-lived shared keys from the provisioning path, and simplify credential lifecycle management and security governance with no shared keys to rotate, store, or accidentally leak.

Together, TLS 1.3 and managed identity strengthen the same Hub linking scenario: TLS 1.3 modernizes how devices and services connect to IoT Hub, while managed identity gives Azure services credential-free authentication during provisioning.

Learn more about how to link an IoT Hub to DPS using managed identity.

Secure update delivery: TLS downloads for Device Update for IoT Hub (Generally Available)

Device Update for IoT Hub can now deliver update content over HTTPS, encrypting update content in transit between the Device Update service and your devices. For customers managing large fleets, this brings update delivery in line with the same modern transport-security expectations now applied to device and service connectivity, and helps teams meet encryption-in-transit and compliance requirements.

Download security is a deployment-level setting available in Device Update data plane API version 2026-06-01. New deployments created with this version use HTTPS by default, while existing deployments continue using their current configuration. Customers that require HTTP downloads can still explicitly select HTTP.

You can configure download security in the Azure portal when creating a deployment, or through the REST API, SDKs, Azure CLI, and automation workflows. Earlier API versions support HTTP downloads only.

Before enabling HTTPS, confirm your devices are ready. Devices must support HTTPS downloads, trust the required root certificate authorities, and support TLS 1.2 or TLS 1.3. Some constrained or embedded devices may require code changes; see additional considerations for constrained or embedded devices.

Learn more about download security for Device Update for IoT Hub.

Why this matters together

With these enhancements, Azure IoT services are taking another step toward secure, modern device onboarding, connectivity, and lifecycle management. TLS 1.3 modernizes how devices and services connect, managed identity removes secrets from the provisioning flow, and TLS download protects update content in transit. Each addresses a different layer of the security model, and together they reflect Microsoft's ongoing, security-first commitment to the platforms our customers build on.

Customers can adopt TLS 1.3 for IoT Hub and managed identity for Hub linking in Preview today and put TLS downloads for Device Update into production right now.