IoT Hub support for Azure Active Directory (Azure AD) and Role-Based Access Control (RBAC) is now generally available for service APIs. This means you can secure your service connections to IoT Hub with much more flexibility and granularity than before.
Existing shared access policy users, including users with Owner and Contributor roles on an IoT hub, are not affected. For better security and ease of use, we encourage everyone to switch to using Azure AD whenever possible.
Granular access control to service APIs
For example, you have a service the needs read access to device identities and device twins. Before, you must give this service access to your IoT hub by using shared access policy to include both the registryRead and the serviceConnect permissions. This works fine, but your service now also has permission to send direct methods and update twin desired properties (as part of serviceConnect). The unnecessary additional privileges can be used by an attacker to mess with your devices, if the credentials are compromised.
For additional security, the industry best practice is to follow the principle of least privilege. With Azure AD and RBAC support, you can grant granular permissions to achieve this. If you want your service to be able to read twins, and nothing else, assign its service principal or managed identity a role with Microsoft.Devices/IotHubs/twin/read permission. And that’s it! This service cannot update twin or send direct methods. You’ve achieved least privilege.
Getting started
To get started, grant your users, groups, service principals or managed identities roles with the new permission. The built-in roles, permissions, and links to samples are published on our documentation page Control access to IoT Hub with Azure AD.