Siemens and Microsoft: Beyond Connectivity to Autonomous, Sustainable Manufacturing
Explore how Siemens Industrial Edge and Microsoft Azure IoT Operations enable secure edge-to-cloud integration, contextualized data, and AI-driven insights—transforming factories into adaptive, future-ready operations.
Azure IoT Hub with ADR (preview): Extending Azure capabilities and certificate management to IoT
Operational excellence in every industry begins by linking the physical world to the digital, enabling organizations to turn raw data from connected assets into actionable insights and real-world improvements. Azure IoT Hub and Azure IoT Operations make this possible by seamlessly integrating data from machines whether on a single factory floor or spread across the globe into a unified platform. Together, they serve as the backbone of connected operations, ensuring that assets, sensors this data is then moved to Microsoft Fabric for real-time analytics and further leveraged by AI agents to drive informed decisions. This approach lets organizations scale efficiently, unifying teams, sites, and systems under the Adaptive Cloud Strategy. It enables use of cloud-native and AI technologies across hybrid, multi-cloud, edge, and IoT environments in a single operational model. Azure IoT Hub empowers organizations to securely and reliably manage connected assets across the globe, providing real-time visibility and control over diverse operations. With proven scalability, broad device support, and robust management tools, IoT Hub delivers a unified platform for developing and operating IoT solutions. Organizations in various industries are using Azure IoT Hub to enhance their operations. In mining, sensors provide real-time safety data and support compliance. Fleet managers track equipment health to boost efficiency and prevent failures, while rail operators use GPS and vibration sensors for precise monitoring and issue detection. Ports utilize conveyor and loading system metrics to optimize scheduling and reduce delays. These examples show how Azure IoT Hub delivers actionable insights, greater safety, and operational efficiency through connected devices. As customers evolve, Azure IoT Hub continues to advance, deepening its integration with the Azure ecosystem and enabling AI-driven, connected operations for the next generation of applications. Today, we’re announcing the public preview of Azure IoT Hub integration with Azure Device Registry bringing IoT devices under the purview of Azure management plane via ARM resource representation and securing them with best-in-class Microsoft-backed X.509 certificate management capabilities. From Connected Devices to Connected Operations Ready-to-use AI platforms are enabling organizations to unlock untapped operational data and gain deeper insights. Organizations are leveraging AI to unify machine and enterprise data, extract actionable insights, and translate them into measurable business gains. They are broadly transitioning from connected devices that simply gather and transmit telemetry, to connected operations which empower supervisors and AI agents to interpret events and respond to scenarios in real time. The integration of Azure IoT Hub with ADR enhancements extends the comprehensive capabilities of Azure to IoT devices. With this integration, Azure Device Registry (ADR) acts as the unified control plane for managing both physical assets from Azure IoT Operations and devices from Azure IoT Hub. It provides a centralized registry, ensuring every entity whether an industrial asset or a connected device is uniquely represented and managed throughout its lifecycle. By integrating with Azure IoT Hub, ADR enables consistent device onboarding, certificate management, and operational visibility at scale. This integration simplifies large-scale IoT fleet management and supports compliance and auditability across diverse deployments. What’s New in this Preview We’re excited to announce the public preview of new capabilities that bring IoT devices into the broader Azure ecosystem. This integration allows IoT to be managed at scale through the Azure management plane. It also strengthens security and enables consistent governance across large deployments: Deep integration with Azure: The Azure Device Registry (ADR) now offers a unified control plane, simplifying identity, security, and policy management for millions of devices. New ADR features make it easier to register, classify, and monitor devices, supporting consistent governance and better operational insights. Combined with Device Provisioning Service (DPS), these enhancements help reduce deployment challenges, speed up time-to-value, and lower operational risks. With IoT Hub integration, IoT Hub devices are represented as Azure resources, providing: One unified registry across multiple IoT Hubs and Azure IoT Operations (AIO) instances. ARM-based management for all Azure resources from cloud to edge. A consolidated view of the entire IoT fleet, simplifying large-scale deployments, monitoring and management. Certificate lifecycle management: Now in public preview, this capability enables secure onboarding and automated certificate rotation for IoT devices, directly integrated with ADR and IoT Hub. X.509 certificates are widely recognized for providing a robust security posture by establishing trusted, cryptographically verifiable device identities. Starting today, customers can use a Microsoft-backed PKI to issue X.509 certificates across their IoT fleets. Devices receive operational certificates that authenticate with IoT Hub, chained to Certificate Authorities (CAs). Policy-driven lifecycle management makes certificate renewal simpler and keeps state in sync with your Hubs. This integration sets the stage for Physical AI by connecting digital and physical systems, thus unlocking new possibilities for data and artificial intelligence. Customer feedback from Private Preview This release has received positive feedback from private preview customers. Particularly the Microsoft-supported PKI and certificate management capabilities, highlighting that previous manual processes were inefficient and fragmented. Customers further noted the advantages of grouping devices from multiple IoT Hubs under a unified namespace, which streamlined management. Moreover, the integration of certificate management within ADR has diminished the reliance on custom solutions. “We were genuinely impressed by how seamless it was to implement. With just a few clicks, clear policy definitions, and two calls in firmware, the entire process became automated, frictionless, and reliable with no external dependencies.” – Uriel Kluk, CTO, Mesh Systems Why It Matters These investments make Azure IoT Hub the cornerstone for connected operations at scale, empowering customers to: Reduce manual cert ops with policy‑driven rotation (fewer outages due to expired certs). Consolidate device registry in ADR for cross‑hub fleet governance. Accelerate compliance audits with centralized certificate lineage. Apply advanced AI tooling for predictive insights and automation. Call to Action Explore the new capabilities in public preview today and start building the next generation of connected operations with Azure IoT Hub and ADR. Learn more on Azure IoT Hub documentation
Bridging the Digital and Physical Worlds with Azure IoT Hub and Azure IoT Operations
Operational excellence starts with people. Empowering those people with the most up to date insights and recommendations requires bridging the gap between the physical and digital worlds to generate the best possible outcomes for real time decision making. Creating this bridge transforms data into insights, insights into intelligent actions, and actions into real-world results. Digital Operations, integrated with AI insights, help make this possible by combining data from connected assets across a variety of physical locations and deployment topologies, and transforming that data into insights and decisions that scale using AI and Analytics. At Microsoft Ignite, we’re extending this vision with new Azure IoT Hub and Azure IoT Operations capabilities to manage connected assets at scale, unify digital operations, and realize AI-enabled outcomes across your enterprise. Connected Operations in Action Azure IoT Hub and Azure IoT Operations form the backbone of connected operations, where every asset, sensor, and system contributes to a continuous loop of intelligence by moving data to Microsoft Fabric for real-time analytics, and for use with AI agents. This pattern applies to nearly every sector of the economy. In manufacturing, these capabilities allow production engineers to predict and avoid equipment failures by analyzing vibration and temperature data at the edge before costly downtime occurs. In energy and utilities, distributed sensors can provide data to control points that help balance load, optimize grid efficiency, and ensure safe operations even in remote areas. In transportation and logistics, connected fleets use edge AI models to detect safety risks in real time, while cloud-based analytics optimize routing and fuel efficiency across entire regions. Across industries, this edge-to-cloud collaboration enables the ability for intelligent systems to sense, reason, and act in the physical world with speed, safety, and precision. From Data to Intelligent Action Organizations today must capture and act on data from both geographically dispersed and tightly collocated assets. That data needs to be processed close to where it’s generated, at the edge, to enable real-time decision-making, reduce latency, and enhance security. At the same time, the cloud remains vital for contextualizing operational data with enterprise systems, training AI models, and managing a consistent identity and security framework across all assets. AI models trained in the cloud can then be deployed back to the edge, where they act on events in real time. Operators can work with AI agents to reason over this data whether it’s structured or unstructured, organized in silos, or contained in free-text fields, to provide results to a mixed team of human and AI operational assets. We have a portfolio of products uniquely designed to make this continuum, from edge to cloud, more intelligent, secure, and repeatable. Together with our partners, we help bridge Operational Technology (OT) with Information Technology (IT) to deliver better business outcomes. New at Ignite: Accelerating Digital Operations We’re excited to share our latest set of investments at Ignite across our portfolio of services. A few key announcements: Azure IoT Hub New Features (Preview): Simplifying Secure Connectivity at Scale Azure IoT Hub empowers organizations to securely and reliably manage connected assets across the globe, providing real-time visibility and control over diverse operations. With proven scalability, broad device support, and robust management tools, IoT Hub delivers a unified platform for developing and operating IoT solutions. As customers evolve, Azure IoT Hub continues to advance, deepening its integration with the Azure ecosystem and enabling AI-driven, connected operations for the next generation of applications. The next generation of Azure IoT Hub investments makes it easier and more secure than ever to connect and manage distributed assets. At Ignite, we’re previewing: New certificate management capabilities that simplify device onboarding and lifecycle management. Integration with Azure Device Registry (ADR) that brings all devices into a common control plane, enabling unified identity, security, and policy management. ADR enhancements that make it easier to register, classify, and monitor assets, paving the way for consistent governance and operational insight across millions of devices. This deeper Azure integration with ADR standardizes operations, simplifies oversight of edge portfolios including IoT devices, and brings the full power of Azure’s management ecosystem to IoT and Digital Operations workloads. Azure IoT Operations New Features (GA): The Foundation for AI in the Physical World Azure IoT Operations is more than an edge-to-cloud data plane, it’s the foundation for achieving AI in the physical world, enabling intelligent operational systems that can perceive, reason, and act to drive new operational efficiencies. Built on Arc-enabled Kubernetes, Azure IoT Operations unifies operational and business data across distributed environments, eliminating silos and providing a repeatable, scalable foundation for autonomous, adaptive operations. By extending familiar Azure management concepts to physical sites, Azure IoT Operations creates an AI-ready infrastructure that supports autonomous, adaptive operations at scale. Our latest GA release of Azure IoT Operations introduced major enhancements: Wasm-powered data graphs deliver fast, modular analytics helping businesses make near real-time decisions at the edge. Expanded connectors now include OPC UA, ONVIF, REST/HTTP, Server-Sent Events (SSE), and direct MQTT for richer industrial and IT integrations. OpenTelemetry (OTel) endpoint support enables seamless telemetry pipelines and observability. Asset health monitoring to provide unprecedented visibility and control. These capabilities help bridge Information Technology, Operational Technology, and data domains, empowering customers to discover, collect, process, and send data using open standards while laying the groundwork for self-optimizing environments where AI agents and human supervisors collaborate seamlessly. Integration with Fabric IQ and Digital Twin Builder To fully unlock the value of connected data, organizations need to contextualize it, linking operational signals to business meaning. Fabric IQ, a new offering announced at Ignite, and Digital Twin Builder in Fabric make this possible, transforming raw telemetry into AI-ready context. This integration allows companies to model complex systems, run simulations, and create intelligent feedback loops across manufacturing, logistics, and energy environments. Edge AI: Real-Time Intelligence in the Physical World Azure’s AI capabilities for edge environments bring intelligence closer to where it matters most. And, because these services are Arc-enabled, organizations can develop, manage and scale AI workloads across diverse environments using consistent tooling. Today, we are announcing updates to two of our key services that enable AI at the edge: Live Video Analysis features (Public Preview) in Azure AI Video Indexer enabled by Arc: delivers real-time agentic video intelligence to improve safety, quality, and operations. Edge RAG (Retrieval Augmented Generation) Public Preview Refresh enables local generative AI reasoning with contextual awareness - empowering AI agents to act within industrial constraints securely and efficiently. These innovations accelerate time to insight and help organizations deploy AI where milliseconds matter. Partner Innovation: Scaling Real Business Value Last year, we showcased the breadth of Azure IoT Operations’ industrial ecosystem. This year, we’re celebrating how partners are integrating, co-innovating, and scaling real customer outcomes. Our partners are packaging repeatable, scalable solutions that connect operational data to enterprise systems—enabling AI-driven insights and automation across sites, regions, and industries. At this year’s Ignite, we’re highlighting some great new partner innovations: NVIDIA is working with Microsoft to enable factory digital twins using the OpenUSD standard Siemens is enabling adaptive production through AI- and digital-twin-powered solutions supported by the integration of Siemens Industrial Edge with Azure IoT Operations Litmus Edge integrates with Azure IoT Operations via the Akri framework to automatically discover industrial devices, enable secure data flows, and support Arc-enabled deployment. Rockwell Automation is streamlining edge-to-cloud integration with its FactoryTalk Optix platform by delivering contextualized, AI-ready data seamlessly within Microsoft Azure IoT Operations architectures. Sight Machine is driving advanced analytics for quality and efficiency across multi-site operations. Through initiatives like Akri, Co-Innovate, and Co-Sell Readiness, our ecosystem is developing managed applications, packaged solutions, and marketplace offerings that accelerate deployment and unlock new revenue streams. These collaborations show how Azure IoT Operations is not just a platform, but a growth engine for industrial transformation. The Path Forward With these advancements, we’re helping organizations bring AI to the physical world by turning data into intelligence and intelligence into action. Customers like Chevron and Husqvarna are scaling beyond initial pilots, expanding their deployments from single-site to multi-site rollouts, unlocking new use cases from predictive maintenance to worker safety, and proving how adaptive cloud architectures deliver measurable impact across global operations. By connecting assets, empowering partners, and delivering open, scalable platform solutions, Microsoft is helping industries achieve resilient, adaptive operations that drive measurable business value. The digital and physical worlds are coming together with solutions that are secure, observable, AI-ready, and built to scale from a single site to global operations. Together, we’re creating a smarter, more connected future. Learn More Learn more about Azure IoT Hub and Azure IoT Operations here: Azure IoT – Internet of Things Platform | Microsoft Azure Learn more about new IoT Hub public preview features here: Azure IoT Hub documentation Discover Partner Solutions: Learn how Litmus and Sight Machine are advancing industrial analytics and integration with Azure IoT Operations. Explore Rockwell Automation and Siemens for more on adaptive cloud architectures and shop floor intelligence. Going to Ignite? If you’re at Ignite this week, you can learn more about how Microsoft enables Industrial Transformation at the following sessions: The New Industrial Frontier Reshaping Digital Operations with AI from Cloud and Edge Or come visit us on the show floor at the Azure Arc Expert Meet Up Focus Area in the Cloud and AI Platforms neighborhoodAzure IoT Operations 2510 Now Generally Available
Introduction We’re thrilled to announce the general availability of Azure IoT Operations 2510, the latest evolution of the adaptive cloud approach for AI in industrial and large scale commercial IoT. With this release, organizations can unlock new levels of scalability, security, and interoperability, empowering teams to seamlessly connect, manage, and analyze data from edge to cloud. What is Azure IoT Operations? Azure IoT Operations is more than an edge-to-cloud data plane, it’s the foundation for AI in physical environments, enabling intelligent systems to perceive, reason, and act in the real world. Built on Arc-enabled Kubernetes clusters, Azure IoT Operations unifies operational and business data across distributed environments, eliminating silos and delivering repeatability and scalability. By extending familiar Azure management concepts to physical sites, AIO creates an AI-ready infrastructure that supports autonomous, adaptive operations at scale. This approach bridges information technology (IT), operational technology (OT), and data domains, empowering customers to discover, collect, process, and send data using open standards while laying the groundwork for self-optimizing environments where AI agents and human supervisors collaborate seamlessly. We've put together a quick demo video showcasing the key features of this 2510 release. Watch below to discover how Azure IoT Operations' modular and scalable data services empowers IT, OT and developers. What’s New in Azure IoT Operations 2510? Management actions: Powerful management actions put you in control of processes and asset configurations, making operations simpler and smarter. Web Assembly (Wasm) data graphs: Wasm-powered data graphs for advanced edge processing, delivering fast, modular analytics and business logic right where your data lives. New connectors: Expanded connector options now include OPC UA, ONVIF, Media, REST/HTTP, and Server-Sent Events (SSE), opening the door to richer integrations across diverse industrial and IT systems. OpenTelemetry (OTel) endpoints: Data flows now support sending data directly to OpenTelemetry collectors, integrating device and system telemetry into your existing observability infrastructure. Improved observability: Real-time health status for assets gives you unmatched visibility and confidence in your IoT ecosystem. Reusable Connector templates: Streamline connector configuration and deployment across clusters. Device support in Azure Device Registry: Azure Device Registry (ADR) now treats devices as first‑class resources within ADR namespaces, enabling logical isolation and role‑based access control at scale. Automatic device and asset discovery and onboarding: Akri‑powered discovery continuously detects devices and industrial assets on the network, then automatically provisions and onboards them (including creating the right connector instances) so telemetry starts flowing with minimal manual setup. MQTT Data Persistence: Data can now be persisted to disk, ensuring durability across broker restarts. X.509 Auth in MQTT broker: The broker now supports X.509 authentication backed by Azure's Device Registry. Flexible RBAC: Built-in roles and custom role definitions to simplify and secure access management for AIO resources. Customers and partners Chevron, through its Facilities and Operations of the Future initiative, deployed Azure IoT Operations with Azure Arc to manage edge-to-cloud workloads across remote oil and gas sites. With a single management plane, the strategy unifies control over thousands of distributed sensors, cameras, robots, and drones. Real-time monitoring and AI enabled anomaly detection not only to enhance operational efficiency but also significantly improve worker safety by reducing routine inspections and enabling remote issue mitigation. This reuse of a global, AI-ready architecture positions Chevron to deliver more reliable, cleaner energy. [microsoft.com] Husqvarna implemented Azure IoT Operations across its global manufacturing network as part of a comprehensive strategy. This adaptive cloud approach integrates cloud, on-premises, and edge systems, preserves legacy investments, and enables real-time edge analytics. The result: data operationalization is 98% faster, imaging costs were slashed by half, productivity was improved, and downtime was reduced. Additionally, AI-driven capabilities like the Factory Companion powered by Azure AI empower technicians with instant, data-informed troubleshooting, shifting maintenance from reactive to predictive across sites. [microsoft.com] Together, these success stories show how Azure IoT Operations, combined with capabilities like Azure Arc, can empower industrial leaders to advance from siloed operations to unified, intelligent systems that boost efficiency, safety, and innovation. Additionally, this year we are celebrating how our partners are integrating, co-innovating, and scaling real customer outcomes. You can learn more about our partner successes at https://aka.ms/Ignite25/DigitalOperationsBlog. Learn more at our launch event Join us at Microsoft Ignite to dive deeper into the latest innovations in Azure IoT Operations 2510. Our sessions will showcase real-world demos plus expert insights on how new capabilities accelerate industrial transformation. Don’t miss the chance to connect with product engineers, explore solution blueprints, and see how Azure IoT Operations lays the foundation for building and scaling physical AI. Get Started Ready to experience the new capabilities in Azure IoT Operations 2510? Explore the latest documentation and quickstart guides at https://aka.ms/AzureIoTOperations Connect with the Azure IoT Tech Community to share feedback and learn from peers.Solving the Data Challenge for Manufacturers with Sight Machine & Azure IoT Operations
Delivering Industrial AI: From Data to Results As manufacturers accelerate their digital transformation, the ability to unify and leverage operational data is the difference between incremental improvement and competitive advantage. Today, we’re launching a joint solution with Sight Machine, purpose-built to solve the OT data challenge and deliver the full Industrial AI stack in weeks, not months: Sight Machine and Microsoft Integrated Industrial AI Stack on Azure This offering is proven in the field, already driving measurable productivity gains for customers in automotive, food, and other sectors with rapid POC cycles and commercial-scale deployments. By integrating Sight Machine’s industrial AI platform with Azure IoT Operations and Microsoft Fabric, we standardize and contextualize machine data at scale, enabling analytics, automation, and actionable insights across the enterprise. What Sets This Solution Apart Fast Deployment: Get the full Industrial AI stack up and running in weeks, not months. End-to-End Integration: Sight Machine’s industrial AI platform works seamlessly with Azure IoT Operations and Microsoft Fabric, standardizing OT data for enterprise-wide use. Real Results: Customers in automotive, food, and other industries are already seeing measurable productivity gains and faster decision cycles. Scalable & Secure: Built on Azure’s adaptive cloud and zero-trust security, with SI partners ready to support commercial scale. Delivering a unified Industrial AI stack Today marks a pivotal moment for manufacturers: the launch of a fully integrated Industrial AI solution, jointly delivered by Microsoft and Sight Machine. This offering brings together the entire Industrial AI stack spanning cloud, edge, and on-premises, enabling organizations to unlock transformative business value. The integrated solution enables customers to transform data into business value by seamlessly contextualizing and moving data from the Edge using Sight Machine and Azure IoT Operations to Microsoft Fabric. Within Microsoft Fabric, the data can be further contextualized and enriched to support AI agents and can be extended to visualize 3D digital twins using NVIDIA Omniverse. The integrated solution has following key components: Azure IoT Operations Streams secure, real-time telemetry from industrial assets to the cloud, enabling visibility and control across edge and enterprise environments. Microsoft Fabric Provides a single analytics and governance platform, merging IT and OT data for enterprise-wide insights. Sight Machine Industrial AI Platform Refines data into “gold-level” quality, fully contextualized and structured for AI, predictive maintenance, and process optimization. M365 Copilot & Agentic Intelligence Surfaces actionable insights directly in familiar tools like Teams and Excel, empowering operators and managers to make informed decisions instantly. NVIDIA Omniverse Integration Extends capabilities into immersive 3D digital twins and physics-based simulations, enabling manufacturers to visualize live operations and test changes virtually before implementing them. Customer Impact Manufacturing is the world’s largest sector, generating twice as much data as any other industry. Yet, the complexity and fragmentation of OT (Operational Technology) data have long limited the adoption of AI at scale. Sight Machine solves this challenge by integrating with every level of the Azure stack, structuring raw OT data into high-quality, contextualized “gold” data, ready for advanced analytics and AI. This integrated offering removes barriers to AI adoption. Manufacturers can connect assets, contextualize data, and deliver actionable insights directly to teams, whether in Teams, Excel, or immersive 3D digital twins. The result: higher productivity, smarter operations, and continuous improvement. Take the Next Step Ready to accelerate your digital transformation? Explore the Sight Machine + Azure IoT Operations solution in the Marketplace. Start your journey to smarter manufacturing today: Sight Machine on AzureFirmware Analysis now Generally Available
Back in June, we announced the public preview of firmware analysis, a new capability available through Azure Arc to help organizations gain visibility into the security of their Internet of Things (IoT), Operational Technology (OT), and network devices. Today, we are excited to announce that firmware analysis is generally available (GA) for all Azure customers. In modern industrial environments, firmware security is a foundational requirement. IoT sensors and smart devices collect the data fueling AI-driven insights; if those devices aren’t secure, your data and operational continuity are at risk. During the preview, we heard from many customers who used firmware analysis to shine a light into their device software and address hidden vulnerabilities before attackers or downtime could strike. With general availability, firmware analysis is ready to help organizations fortify the “blind spots” in their infrastructure – from factory-floor sensors to branch office routers – by analyzing the software that runs on those devices. What Firmware Analysis Does for You Firmware analysis examines the low-level software (firmware) that powers IoT, OT and network devices, with no agent required on the device. You can upload a firmware image (for example, an extracted embedded Linux image), and the cloud service performs an automated security inspection. Key features include: Software inventory & vulnerability scanning: The service builds a Software Bill of Materials (SBOM) of components within the firmware and checks each component against known CVEs (Common Vulnerabilities and Exposures). This quickly surfaces any known vulnerabilities in your device’s software stack so you can prioritize patching those issues. Security configuration and hardening check: Firmware analysis evaluates how the firmware binaries are built, looking for security hardening measures (e.g. stack protections, ASLR) or dangerous configurations. If certain best practices are missing, the firmware might be easier to exploit – the tool flags this to inform the device manufacturer or your security team. Credential and secrets discovery: The analysis finds any hard-coded credentials (user accounts/password hashes) present in the firmware, as well as embedded cryptographic material like SSL/TLS certificates or keys. These could pose serious risks – for instance, default passwords that attackers could exploit (recall the Mirai botnet using factory-default creds) are identified so you can mitigate them. Any discovered certificates or keys can indicate potentially insecure design if left in production firmware. Comprehensive report: All security findings – from the Software Bill of Materials (SBOM), list of vulnerabilities to hardening recommendations and exposed secrets – are provided in a detailed report for each firmware image analyzed. This gives device makers and operators actionable intelligence to improve their device security posture. In short, firmware analysis provides deep insights into the contents and security quality of device firmware. It turns opaque firmware into transparent data, helping you answer, “What’s really inside my device software?” so you can address weaknesses proactively. What’s New and Licensing We’ve been hard at work making firmware analysis even better as we move to GA. Based on preview feedback, we’ve addressed bugs, implemented usability suggestions and improved the firmware analysis SDKs, CLI and PowerShell extensions. A new Azure resource called “firmware workspace” now stores analyzed firmware images. Firmware analysis workspaces are currently available as a Free Firmware Analysis Workspace SKU with capacity limits. Getting Started If you have IoT, OT and network devices in your environment, use firmware analysis to test just how secure your devices are. Getting started is easy: access firmware analysis by searching “firmware analysis” in the Azure portal, or access using this link. Onboard your subscription and then upload firmware images for analysis. For a step-by-step tutorial, visit our official documentation. The service currently supports embedded Linux-based images up to 1GB in size. We want to thank all the preview participants who tested firmware analysis and provided feedback. You helped us refine the service for GA and we’re thrilled to make this powerful tool broadly available to help secure IoT, OT and network devices around the world. We can’t wait to see how you put it to work. As always, we value your feedback, so please let us know what you think.Announcing the Firmware Analysis Public Preview
Consider an organization with thousands of smart sensors, IoT/OT and network equipment deployed on factory floors. Most of these devices are running full operating systems, but unlike traditional IT endpoints which often run security agents, IoT/OT and network devices frequently function as “black boxes”: you have little visibility into what software they’re running, which patches are applied, or what vulnerabilities might exist within them. This is the challenge many organizations face with IoT/OT and networking equipment - when a critical vulnerability is disclosed, how do you know which devices are at risk? To help address this challenge, we are excited to announce the public preview of firmware analysis, a new capability available through Azure Arc. This extends the firmware analysis feature we introduced in Microsoft Defender for IoT, making it available to a broader range of customers and scenarios through Azure. Our goal is to provide deeper visibility into IoT/OT and network devices by analyzing the foundational software (firmware) they run. Firmware analysis will also help companies that build firmware for devices better meet emerging cybersecurity regulations on their products. In this post, we’ll explain how the service works, its key features, and how it helps secure the sensors and edge devices that feed data into AI-driven industrial transformation. Securing Edge Devices to Power AI-Driven Industrial Transformation In modern industrial environments, data is king. Organizations are embracing Industry 4.0 and AI-driven solutions to optimize operations, leveraging advanced analytics and machine learning. The path to AI-driven industrial transformation is fueled by data – and much of that data comes from sensors and smart devices at the edge of the network. These edge devices measure temperature, pressure, vibration, and dozens of other parameters on the factory floor or in remote sites, feeding streams of information to cloud platforms where AI models turn data into insights. In fact, sensors are the frontline data collectors in systems like predictive maintenance, continuously monitoring equipment and generating the raw data that powers AI predictions. However, if those edge devices, sensors, and networking equipment are not secure and become compromised, the quality and reliability of the data (and thus the AI insights) cannot be guaranteed. Vulnerable devices can also be used by attackers to establish a foothold in the network, allowing them to move laterally to compromise other critical systems. In an industrial setting this could mean safety hazards, unplanned downtime, or costly inefficiencies. This is why securing the smart devices and networking equipment at the foundation of your industrial IoT data pipeline is so critical to digital transformation initiatives. By using firmware analysis on the devices’ firmware before deployment (and regularly as firmware updates roll out), the manufacturer and plant operators gain visibility into the security posture of their environment. For example, they might discover that a particular device model’s firmware contains an outdated open-source library with a known critical vulnerability. With that insight, they can work with the vendor to get a patched firmware update before any exploit occurs in the field. Or the analysis might reveal a hard-coded passwords for maintenance account in the device; the ops team can then ensure those credentials are changed or the device is isolated in a network segment with additional monitoring. In short, firmware analysis provides actionable intelligence to fortify each link in the chain of devices that your industrial systems depend on. The result is a more secure, resilient data foundation for your AI-driven transformation efforts – leading to reliable insights and safer, smarter operations on the plant floor. Firmware analysis is also a key tool used by device builders – by analyzing device firmware images before they are delivered to customers, builders can make sure that new releases and firmware updates meet their and their customers’ security standards. Firmware analysis is a key component to address emerging cybersecurity regulations such as the EU Cyber Resilience Act and the U.S. Cyber Trust Mark. How Firmware Analysis Works and Key Features Firmware analysis takes a binary firmware image (the low-level software running on an IoT/OT and network device) and conducts an automated security analysis. You can upload an unencrypted, embedded Linux-based firmware image to the firmware analysis portal. The service unpacks the image, inspects its file system, and identifies potential hidden threat vectors – all without needing any agent on the device. Here are the main capabilities of the firmware analysis service: Identifying software components and vulnerabilities: The first thing the analysis does is produce an inventory of software components found inside the firmware, generating a Software Bill of Materials (SBOM). This inventory focuses especially on open-source packages used in the firmware. Using this SBOM, the service then scans for known vulnerabilities by checking the identified components against public Common Vulnerabilities and Exposures (CVEs) databases. This surfaces any known security flaws in the device’s software stack, allowing device manufacturers and operators to prioritize patches for those issues. Analyzing binaries for security hardening: Beyond known vulnerabilities, our firmware analysis examines how the firmware’s binaries were built and whether they follow security best practices. For example, it checks for protections like stack canaries, ASLR (Address Space Layout Randomization), and other compile-time defenses. This “binary hardening” assessment indicates how resistant the device’s software might be to exploitation. If the firmware lacks certain protections, it suggests the device could be easier to exploit and highlights a need for improved secure development practices by the manufacturer. In short, this feature acts as a gauge of the device’s overall security hygiene in its compiled code. Finding weak credentials and embedded secrets: Another critical aspect of the analysis is identifying hard-coded user accounts or credentials in the firmware. Hard-coded or default passwords are a well-known weakness in IoT devices – for instance, the Mirai botnet famously leveraged a list of over 60 factory-default usernames and passwords to hijack IoT devices for DDoS attacks. Firmware analysis will flag any built-in user accounts and the password hash algorithms used, so manufacturers can remove or strengthen them, and enterprise security teams can avoid deploying devices with known default credentials. Additionally, the firmware analysis looks for cryptographic materials embedded in the image. It will detect things like expired or self-signed TLS/SSL certificates, which could jeopardize secure communications from a device. It also searches for any public or private cryptographic keys left inside the firmware – secrets that, if found by adversaries, could grant unauthorized access to the device or associated cloud services. By uncovering these hidden secrets, the service helps eliminate serious risks that might otherwise go unnoticed in the device’s software. All these insights – from software inventory and CVEs to hardening checks and secret material detection – are provided in a detailed report for each firmware image you analyze. Firmware analysis provides deep insights, clear visibility, and actionable intelligence into your devices' security posture, enabling you to confidently operate your industrial environments in the era of AI-driven industrial transformation. Getting Started and What’s Next If you have IoT/OT and network devices in your environment, use firmware analysis to test just how secure your devices are. Getting started is easy: access firmware analysis public preview by searching on “firmware analysis” in the Azure portal, or access using this link. In the future, firmware analysis will be more tightly integrated into the Azure portal. Onboard your subscription to the preview and then upload firmware images for analysis - here is a step-by-step tutorial. The service currently supports embedded Linux-based images up to 1GB in size. In this preview phase, there is no cost to analyze your firmware – our goal is to gather feedback. We are excited to share this capability with you, as it provides a powerful new tool for securing IoT/OT and network devices at scale. By shedding light on the hidden risks in device firmware, firmware analysis helps you protect the very devices that enable your AI and digital transformation initiatives. Firmware is no longer just low-level code—it’s a high-stakes surface for attack, and one that demands visibility and control. Firmware analysis equips security teams, engineers, and plant operators with the intelligence needed to act decisively—before vulnerabilities become headlines, and before attackers get a foothold. Please give the firmware analysis preview a try and let us know what you think.Microsoft and Siemens: Accelerating Digital Transformation Together
In the ever-evolving landscape of industrial manufacturing, the collaboration between Microsoft and Siemens marks a significant step towards achieving adaptive and integrated production systems. Leveraging the capabilities of Siemens Xcelerator and Microsoft’s adaptive cloud approach, this partnership aims to bridge the gap between operational technology (OT) and information technology (IT) to create a seamless, data-driven production environment. Breaking Down Silos with Edge-to-Cloud Integration The convergence of IT and OT environments is revolutionizing industrial data and workloads, enabling the creation of adaptive production systems that enhance efficiency, flexibility, and innovation. Edge computing plays a pivotal role in this transformation by capturing and processing data directly at the source. Siemens Industrial Edge seamlessly interfaces with Microsoft Azure IoT Operations, enabling manufacturers to integrate MQTT and OPC UA data flows from the Industrial Edge with Azure IoT Operations. This joint effort ensures continuous data flows from industrial assets to Azure IoT Operations, fostering an interoperable OT and IT data plane. A Collaborative Approach to Modern Manufacturing Siemens brings extensive expertise in factory automation and digital transformation to this collaboration. Siemens Industrial Edge facilitates the deployment and management of workloads and connectivity applications, seamlessly connecting industrial assets to the cloud. This powerful OT data plane, provided by Siemens Industrial Edge, addresses mission-critical production applications such as virtualized control, low-latency closed-loop AI, executable digital twins, and production line-level analytics. Azure’s adaptive cloud approach integrates teams, sites, and systems into a unified model for operations, security, applications, and data across hybrid, multicloud, edge, and IoT environments. This approach ensures that all aspects of an organization's digital infrastructure work together, enhancing efficiency and collaboration. Azure IoT Operations, a component of this adaptive cloud approach, provides tools and infrastructure to connect edge devices while integrating data, enabling organizations to optimize their operations and utilize the potential of their IoT environments. Driving Digital Transformation Together As manufacturers face increasingly challenging conditions, such as scarce resources and volatile supply chains, the need for adaptive and scalable production systems has never been greater. Siemens and Microsoft are committed to reducing the complexity of integrating and managing infrastructure, data, and applications. This collaboration enables manufacturers to accelerate their digital transformation, moving from automated to adaptive production systems. Harnessing AI for Enhanced Production The partnership between Microsoft and Siemens empowers manufacturers to leverage AI to improve machine performance, product quality, and operational efficiency. By utilizing the Siemens Industrial AI portfolio alongside Azure Machine Learning services, manufacturers can train AI models in the cloud and deploy them at the edge with low latency. This capability allows for real-time insights and decision-making, enhancing overall equipment efficiency and reducing manual rework and costs. The Road Ahead The partnership between Siemens and Microsoft represents a significant milestone in the journey towards digital transformation. By providing a seamless data flow from the shopfloor to the cloud, this collaboration empowers manufacturers to harness advanced technologies such as AI and digital twins to streamline their production processes. As both companies continue to innovate and expand their capabilities, the future of manufacturing looks brighter than ever. For further details on Microsoft’s adaptive cloud approach, visit https://azure.microsoft.com/en-us/solutions/adaptive-cloud. You can also visit the Microsoft booth at Hannover Messe 2025 in Hall 017, Booth G06 to learn more and see the adaptive cloud approach and Azure IoT Operations in action. For more information on Siemens Industrial Edge, visit Siemens Xcelerator: Siemens accelerates IT and OT integration with Microsoft for Edge, Cloud, AI and Simulation | Press | Company | SiemensScaling industrial transformation with a robust partner ecosystem
In recent years, manufacturers have been on a journey to incorporate intelligent technologies like AI into their business processes. These exciting advancements are happening within an extended ecosystem, encompassing everything from planning and manufacturing to distribution and servicing of goods. A defining aspect of many such business processes is their continuous generation of data, which, when effectively contextualized and analyzed, can unlock critical business outcomes, including minimizing downtime, reducing waste, enhancing quality, improving sustainability, and boosting worker productivity. In addition to analytics, a comprehensive data governance strategy is fundamental as it supports the ability to embrace ecosystem-driven collaboration, a key component to unlock the full potential of AI-driven manufacturing. Challenges in meeting the promise of IT and OT integration With AI only as good as the data behind it, the ability to harness data across an ecosystem is paramount. However, the inherent complexities within industrial environments create digital transformation barriers. Each factory has its own unique mix of automation equipment and software configurations based on site-specific production processes. Management and data handling are also system and site specific. When organizations try to scale transformation efforts across different sites, these complexities multiply, with individual IT management systems adding permutations. Due to the variety of source and configuration combinations, pulling the right data, semantics, and contextualization into an external analysis platform becomes incredibly difficult and cost prohibitive. As a result, the ability to scale an outcome through the use of a digital feedback loop is completely out of reach. How an adaptive cloud approach supports operational transformation To overcome these challenges, organizations can benefit from a consistent approach to industrial data value realization that is repeatable across sites. Azure’s adaptive cloud approach enables organizations to secure, manage, and scale industrial operations by unifying data, applications, and infrastructure across edge and cloud environments. By leveraging the adaptive cloud approach, businesses can create a unified data foundation, breaking down operational silos to drive AI-driven insights and improved collaboration between IT and OT teams. Azure IoT Operations, enabled by Arc empowers customers to easily move machine and process data between the edge and cloud in a highly unified and repeatable way. Under the hood, Azure IoT Operations is a full-stack data plane that runs in on-premises Arc-enabled Kubernetes clusters. It enables customers to discover Assets via Akri and collect data. Then, customers can process and send data from the edge to the cloud using open standards and open protocols that are managed and supported by Microsoft. This solution helps enable unified data flow from facilities to natively integrated cloud destinations, including Microsoft Fabric, Azure Event Hubs, and Azure Event Grid's MQTT broker which provides real-time insights and AI-driven decision-making. Azure IoT Operations leverages Azure Arc to extend the cloud management pattern down to the physical site, using the same cloud deployment and management controls as Azure to enable unique advantages in repeatability and scalability across the enterprise. While Azure's adaptive cloud approach can provide a foundation to simplify everything from data collection to scaling AI initiatives, Microsoft is a platform company, and our partners are essential to success in the complex industrial market. Why a partner ecosystem is critical for enabling customer success Achieving business outcomes from industrial data requires navigating the complexity of interconnected technology landscapes, where diverse technologies and systems must cohesively integrate. The siloed IT, OT, and ET data that results from these diverse systems can slow AI adoption, limiting manufacturers’ ability to extract real-time insights. A collaborative vendor network can help address these challenges by enabling streamlined data exchange, enhanced automation, and increased operational intelligence. The transformation enabled by this network demands a collective approach, bringing together industrial automation partners offering industry-specific AI and analytics solutions, system integrators collaboratively engineering IT-OT solutions, OEMs modernizing production lines, and ISVs to develop industry-specific solutions that drive efficiency and scalability. A multi-cloud, open, and interoperable approach can allow businesses to connect engineering, production, and supply chain workflows into AI-driven digital infrastructure from cloud to edge. Manufacturers operate in complex multi-vendor environments that demand flexibility and interoperability. Choosing to adopt an open and collaborative partner network approach offers the opportunity to extend the life of investments and adopt AI and automation gradually. In addition, unlike closed models that often lead to vendor lock in, open ecosystems enhance security and governance through consistent policy enforcement, interoperability, and real-time visibility across multi-cloud, edge, and on-prem environments. For instance, a solution like Azure Arc offers centralized security controls, automated compliance and third-party tool integration. Industrial enterprises desire a unified, scalable AI-cloud-edge strategy to optimize engineering, production, and supply chain workflows. To make outcomes from Industrial AI initiatives a reality, organizations — including traditional competitors —should consider embracing partnerships, open standards and an adaptive cloud approach to enable easier connectivity and interoperability. Microsoft’s open, scalable, and multi-cloud ecosystem helps enable more efficient integration of Azure solutions with third-party platforms (public and private clouds) and open industry standards that enable data interoperability across IoT, AI, and automation solutions. Learn more about how Microsoft, along with partners, is reimagining how intelligent digital threads and AI agents will transform the manufacturing industry here. Join Us - Industrial AI in Action at Hannover Messe 2025 Join us at the Microsoft booth in Digital Ecosystems Hall 17 to explore the latest innovations in our partner ecosystem supporting the transformation of industrial operations. Experience live demonstrations showcasing how AI-driven manufacturing, real-time data insights, and an adaptive cloud approach drive efficiency, flexibility, and innovation. See firsthand how Microsoft and its partners mentioned below are enabling intelligent automation, predictive quality control, and improved IT/OT integration to accelerate digital transformation. Avanade Avanade excels in IT/OT integration and advanced manufacturing solutions, with specialized expertise in integrating PLM, ERP, and MES systems for digital continuity across design, manufacturing, supply chain, and service processes. Avanade offers dynamic sourcing for flexible procurement and supplier collaboration, process flexibility for diverse product variants, and human-machine collaboration to meet new product requirements. At HMI 2025, Avanade and Microsoft will showcase advanced closed-loop manufacturing demos using AI machine vision for quality control, integrated with Azure IoT Operations—which leverages MQTT and OPC UA protocols to streamline data transport and connectivity. Visit the Microsoft booth to explore how seamless system integration, dynamic sourcing, and human-machine collaboration can help produce superior products faster with less waste. Learn more about Avanade at HMI 2025. Capgemini Microsoft and Capgemini are driving the next era of smart manufacturing by embracing the adaptive cloud approach to accelerate digital transformation. Through Capgemini’s Intelligent Industry offerings worker performance and operational efficiencies can be improved through AI-driven processes—empowering manufacturers to move beyond manual workflows and unlock new levels of productivity. Capgemini integrates across edge to cloud environments using services like Azure IoT Operations, Azure AI, and Microsoft Fabric to optimize quality, and overall equipment effectiveness (OEE) for manufacturers. Join us at Capgemini’s Theatre Talk at HMI on Thursday, April 3 at 10:00am, where industry leaders will share how AI, when paired with edge to cloud technologies, can unlock the full potential of smart factories. Be part of the conversation—see what’s next in digital manufacturing! Celebal Technologies The Operational Technology (OT) Data Liberator by Celebal Technologies extracts, processes, and integrates OT data into a centralized Lakehouse, ensuring metadata synchronization, real-time streaming, historical data retrieval, and a resilient data pipeline—all while maintaining full data governance and simplified infrastructure management within the customer’s network. Deployed as a Kubernetes workload at the edge, the Liberator streams MQTT data directly into Azure IoT Operations and can be configured to leverage Akri-enabled connectors for protocol translation, eliminating traditional data silos and accelerating digital transformation. Powered by Azure IoT Operations, the OT Data Liberator delivers secure, scalable connectivity across legacy and modern OT systems, enabling data transformation and management. From manufacturing and energy to utilities and resources, this collaboration empowers industries to optimize operations, enhance security, and scale digital transformation with confidence. Learn more here. Litmus Litmus, a leader in Industrial Data Operations, has partnered with Microsoft to accelerate industrial transformation by integrating Litmus Edge with Azure IoT Operations. This collaboration enables seamless connectivity through the Akri Litmus connector, supporting data processing and management of factory edge devices while bridging legacy OT systems with Microsoft’s edge to cloud technologies, including Azure Arc and Microsoft Fabric. The joint solution delivers zero-code protocol integration, centralized device orchestration, and real-time insights, simplifying edge-to-cloud data operations. Key outcomes include faster AI deployment, reduced downtime, improved product quality, and enhanced operational agility across industrial environments. Together, Litmus and Microsoft offer a unified scalable platform that empowers manufacturers to modernize operations and easily replicate lines and sites to unlock the full potential of their industrial data. Visit the Microsoft booth to see a live demo of this powerful edge-to-cloud solution in action and learn more here. Loopr.ai Loopr delivers real-time, AI-driven visual inspection for complex assemblies, performing over 400,000 inspections annually to enhance quality consistency, workforce efficiency, and cost reduction. With Azure IoT Operations, Loopr efficiently integrates with on-premise factory systems, enterprise ERP, and cloud analytics like Microsoft Fabric, enabling manufacturers to deploy AI-driven quality control within their existing Azure infrastructure. Loopr powered by Azure IoT Operations enables customers to overcome scaling challenges, optimize workflows and streamline edge-to-cloud data transport, enabling real-time analytics and enterprise-wide deployment. For example, a North American automotive manufacturer recently integrated Loopr's AI-powered visual inspection system to automate their final quality checks. This implementation led to improved precision on the production line and a reduction in defect rates. MTEK MTEK Industry AB is transforming digitalization of discrete manufacturing with its Digital Production System and advanced integration platforms. Through collaboration with Microsoft, MTEK has successfully deployed MBrain and the Manufacturing Integration Platform (Mint) in production facilities. Utilizing the full Microsoft stack, including Azure IoT Operations, Dynamics 365, Microsoft Fabric and Teams (to name a few), MTEK achieves IT/OT/human convergence, optimizing operations while reducing environmental impact. MBrain integrates into Azure IoT Operations supporting MQTT and OPC UA, enabling immediate data monitoring and management. Together, Microsoft and MTEK deliver easily integrated data exchange between edge devices and the cloud by supporting real-time analytics and decision-making. Join us at Hannover Messe 2025 to discover how MBrain's real-time data analytics and IT/OT/human convergence empower manufacturers to achieve total value capture. Schneider Electric Schneider Electric enables digital transformation by integrating world-leading automation and energy technologies, endpoint to cloud connecting products, controls, software and services, across the entire lifecycle, enabling integrated company management, for homes, buildings, data centers, infrastructure, and industries. Schneider Electric is partnering with Microsoft to transform manufacturing into an AI-powered, open, software-defined industry. Microsoft's AI, Edge & Cloud patterns are combined with Schneider Electric's advanced, secure, and user-friendly industrial automation edge solution. Join us at HMI 2025 to experience this direct-to-cloud, secure interface that empowers innovative, data-driven approaches to modernize processes and products using AI agents and digital twin solutions with real-time simulation. Siemens Siemens develops technologies that power progress across industrial automation, infrastructure, transportation, and healthcare, with a strong emphasis on digital solutions and sustainability globally. The collaboration with Siemens leverages Siemens Industrial Edge and Microsoft Azure IoT Operations to create integrated, data-driven production environments that address customer pain points. This partnership helps ensure data flow from the shop floor to the cloud, empowering manufacturers to harness advanced technologies like AI and digital twins to streamline their production processes. Learn more about how Siemens and Microsoft are partnering to accelerate IT and OT integration at HMI 2025. Sight Machine Sight Machine’s industrial AI data platform, now deployable at the edge with Azure IoT Operations, unifies real-time production data, enhancing data accessibility and productivity. At the Microsoft booth come and discover how Sight Machine and Microsoft are revolutionizing beverage bottling operations by reducing downtime and increasing availability through real-time plant data, AI-driven insights, and collaboration tools, all powered by Microsoft’s secure, scalable cloud infrastructure. Microsoft fosters collaborative innovation, empowering partners to drive industrial transformation. At Hannover Messe 2025, Sight Machine will also demonstrate its integration with NVIDIA Omniverse, offering real-time 3D visualization, rapid troubleshooting, and root cause analysis. Co-developed by Microsoft, NVIDIA, and Sight Machine, this solution enhances manufacturing performance. Visit the NVIDIA booth to learn more. Symphony AI SymphonyAI revolutionizes the Intelligent Factory with Predictive, Generative and Agentic AI solutions for industrial verticals across manufacturing, consumer goods and energy. Their software drives end-to-end digital transformation from edge to cloud, integrating data sources, contextualizing information, and powering AI-driven applications. At HMI, discover how SymphonyAI’s IRIS Foundry Industrial DataOps platform is extending capabilities to the edge to help manufacturers leverage factory data to expedite AI drive value in maintenance, quality, process optimization, closed-loop operations, and overall plant performance. The new edge capabilities easily and securely connect to factory systems, store and transform data, automate workflows and leverage Azure IoT Operations Dataflows and MQTT Broker to smoothly transport data to IRIS Foundry, unlocking actionable AI for factory operations. Don't miss this opportunity to see how we can transform your operations—join us at HMI for the demo. Learn more AI and the adaptive cloud approach are transforming how industries design, build and operate, driving the next wave of efficiency, agility, and innovation. To fully harness this potential, organizations should embrace a collaborative ecosystem that fosters AI-driven insights, simplified data integration, and secure digital transformation. The future of manufacturing is intelligent, interconnected, and AI-powered—and success depends on a strong partner network, a flexible cloud strategy, and a commitment to open, multi-cloud innovation. By working together, we can accelerate industrial transformation, overcome complex challenges, and unlock the full power of smart manufacturing. Learn more about the adaptive cloud approach and explore comprehensive cloud-to-edge scenarios designed for specific industry needs with Arc Jumpstart Agora.Automatic IoT Edge Certificate Management with GlobalSign EST
(Republish from Feb 15, 2023) When it comes to managing IoT devices, security is of the utmost importance. But you’d also rest easier if devices are secure without concern about manual certificate management. In this post, we'll show you a solution that streamlines IoT Edge certificate management using GlobalSign's IoT Edge Enroll EST service. An Analogy Think of each IoT Edge device as a new driver, ready to hit the road and communicate with the IoT Hub. And like a new driver, each device needs its own set of credentials that need renewal. Here's how GlobalSign's EST service makes it a breeze: Birth Certificate: During manufacturing, each device is given a unique Initial Device Identifier (IDevID) certificate and private key (ideally, something like Trusted Computing Group’s (TCG) Trusted Platform Module’s (TPM) Endorsement Key (EK) certificates with factory burnt secured hardware backed private keys). This is like the device's birth certificate, proving its identity. Driver's License: When the device connects for the first time, it uses its IDevID to authenticate with GlobalSign for certificate signing request (CSR). In return, GlobalSign provides a short-lived Locally Significant Device Identifier (LDevID) certificate from a trusted root CA. This LDevID acts as the device's driver's license, allowing it to operate for some time. The LDevID serves as the device's unique identifier in IoT Hub, registered through Device Provisioning Service (DPS). Automatic Renewal: To make sure your devices never lose their communication privileges, IoT Edge automatically renews the LDevID certificates before expiration. Like a driver license renewal, but automated! By using GlobalSign's EST service, you can enjoy secure certificate management for your IoT Edge devices. It's like having a personal assistant renewing your driver's license for you. Give it a try to start streamlining your IoT Edge certificate management. Prerequisites An IoT hub and Device Provisioning Service linked to it. A GlobalSign demo account: Sign up for Test Your Azure IoT Edge PoC with live device certificates from GlobalSign's IoT Edge Enroll. You'll receive an email with details for your EST server endpoint within a few days, including three endpoints (IDevID, LDevID, and Edge CA). Reply to the GlobalSign contact and ask to: Enable X.509 authentication (mTLS) for both the LDevID and the Edge CA endpoints Turn off “re-enrollment forcing” (the default behavior with GlobalSign IoT Edge Enroll is that it notices that a previously issued certificate was presented and "upgrade" the request to the reenrollment workflow. This overrides the subject CN to be the same as the previously issued certificate. Typically, customers would use a separate CA for the bootstrap/idevid, so in practice this outcome usually wouldn't be seen. But for simplicity of this post, it’s easier to ask GlobalSign to respect the certificate signing request (CSR) and not perform the “upgrade”). Linux machine, VM, or device with IoT Edge installed: Don't provision the IoT Edge device identity. Create the IDevID In this section, we create the IDevID certificate, which serves as the device's birth certificate. It’s a one-time process that occurs during device manufacturing, and ensures that the initial secret value for first-time authentication to GlobalSign never leaves the factory. Later, when the device wakes up, it will use the IDevID certificate to get a driver's license, or the LDevID certificate. On your local machine or SSH into the IoT Edge device, create directories to store certificates and private keys for IoT Edge and assign ownership of these directories to the "aziotcs" certificate service and "aziotks" key service. sudo mkdir -p /var/aziot/secrets sudo mkdir /var/aziot/certs -p Retrieve the GlobalSign demo root CA certificate with curl and convert it to PEM format using openssl. This certificate serves as the common root of trust between IoT Edge, GlobalSign, and DPS (and thus IoT Hub). curl https://<YOUR-IDEVID-ENDPOINT>.est.edge.dev.globalsign.com:443/.well-known/est/cacerts| openssl base64 -d | openssl pkcs7 -inform DER -outform PEM -print_certs | openssl x509 -out globalsign-root.cert.pem Use openssl to create a new private key and certificate signing request (CSR). openssl req -nodes -new -subj /CN=IDevID -sha256 -keyout IDevID.key.pem -out IDevID.csr Send the CSR to GlobalSign's simple enroll EST endpoint using curl, to obtain the IDevID certificate that is signed with the root CA and paired with the private key created earlier. curl -X POST --data-binary "@IDevID.csr" -H "Content-Transfer-Encoding:base64" -H "Secret-Value: <YOUR-SECRET-VALUE>" -H "Content-Type:application/pkcs10" https://<YOUR-IDEVID-ENDPOINT>.est.edge.dev.globalsign.com:443/.well-known/est/simpleenroll | openssl base64 -d | openssl pkcs7 -inform DER -outform PEM -print_certs | openssl x509 -out IDevID.cert.pem Move the certificates and private keys to the directories you created earlier, and give the IoT Edge certificate and key services the appropriate permissions to the PEM files and directories. sudo cp *cert.pem /var/aziot/certs sudo cp *key.pem /var/aziot/secrets sudo chown aziotcs:aziotcs /var/aziot/certs/*.cert.pem sudo chmod 644 /var/aziot/certs/*.cert.pem sudo chown aziotks:aziotks /var/aziot/secrets/*.key.pem sudo chmod 600 /var/aziot/secrets/*.key.pem sudo chown aziotcs:aziotcs /var/aziot/certs sudo chmod 755 /var/aziot/certs sudo chown aziotks:aziotks /var/aziot/secrets sudo chmod 700 /var/aziot/secrets Use the ls command to verify that the files are in place with the proper permissions and match the expected values. $ sudo ls -lR /var/aziot /var/aziot: total 8 drwxr-xr-x 2 aziotcs aziotcs 4096 Jan 11 14:38 certs drwx------ 2 aziotks aziotks 4096 Jan 11 14:38 secrets /var/aziot/certs: total 8 -rw-r--r-- 1 aziotcs aziotcs 1298 Jan 11 14:38 IDevID.cert.pem -rw-r--r-- 1 aziotcs aziotcs 1383 Jan 11 14:38 globalsign-root.cert.pem /var/aziot/secrets: total 4 -rw------- 1 aziotks aziotks 1704 Jan 11 14:38 IDevID.key.pem Prepare DPS for provisioning Here's how to get DPS ready for device provisioning: If you haven’t already done so, create an IoT hub and DPS, then link them together. Go to the DPS instance in Azure portal, then select Certificates > Add. In the pop-up, select your GlobalSign EST root CA certificate. You can use SFTP, VS Code Remote Extension to copy it from the IoT Edge device, or use curl to get it again. Select Set certificate status to verified on upload so that you can skip proof-of-possession. Click Save. Create a DPS enrollment group. Make sure attestation type is set to Certificate, IoT Edge device is set to True, certificate type is set to CA Certificate, and the root CA you just uploaded is set as the Primary Certificate. Now, your DPS is ready to provision the IoT Edge device when it wakes up, using the root CA certificate as the trusted source of authentication. Configure and start the IoT Edge device In this section, we set up the IoT Edge device with its birth certificate (IDevID) to communicate with the GlobalSign EST server and receive its driver license (LDevID). The LDevID allows the device to talk to DPS and get the proper authorization for communication with IoT Hub. On the IoT Edge device, create a config file config.toml. Replace marked parameters with details from your GlobalSign account and DPS. # The CA cert of the demo root we got from earlier [cert_issuance.est] trusted_certs = ["file:///var/aziot/certs/globalsign-root.cert.pem"] # Empty because the LDevID (device ID) and Edge CA endpoints are different [cert_issuance.est.urls] # Use the IDevID cert and private key for authentication to EST [cert_issuance.est.auth] identity_cert = "file:///var/aziot/certs/IDevID.cert.pem" identity_pk = "file:///var/aziot/secrets/IDevID.key.pem" # DPS provisioning with X.509 certificate # Replace with ID Scope from your DPS [provisioning] source = "dps" global_endpoint = "https://global.azure-devices-provisioning.net" id_scope = "<DPS-ID-SCOPE e.g 0AB12345678>" [provisioning.attestation] method = "x509" registration_id = "my-device-id" # Get LDevID (device ID) cert from EST with auto renew [provisioning.attestation.identity_cert] method = "est" common_name = "my-device-id" url = "https://<YOUR-LDEVID-ENDPOINT>.est.edge.dev.globalsign.com:443/.well-known/est/" [provisioning.attestation.identity_cert.auto_renew] threshold = "80%" retry = "4%" # Get Edge CA from EST also with auto renew [edge_ca] method = "est" url = "https://<YOUR-EDGE-CA-ENDPOINT>.est.edge.dev.globalsign.com:443/.well-known/est/" [edge_ca.auto_renew] threshold = "80%" retry = "4%" Copy the file over as root and apply configuration with iotedge config apply. This also starts the IoT Edge device. sudo cp config.toml /etc/aziot/config.toml sudo iotedge config apply Verify that the configuration was successful by using the iotedge check command. You should see successful checks on the connection with DPS and the status of certificates and keys. You can also check in your DPS Enrollment Group > Registration Records or IoT Hub to see that the IoT Edge device is registered (shown below). Note: if you haven’t configured an IoT Edge deployment, you might see an error about edgeHub container being missing in iotedge check and a 417 in IoT Hub. That’s normal until you add the deployment via Set modules. On the device, check the new certificates from the EST server. In the "/var/lib/aziot/certd/certs" directory, you should see three different certificates starting with "estid", "aziotedgeca", and "deviceid". Use OpenSSL to inspect them. Note: the certificate names are randomly generated, use "ls" to find their names and paste them into the OpenSSL command. sudo ls /var/lib/aziot/certd/certs sudo openssl x509 -text -in /var/lib/aziot/certd/certs/estid-<GUID>.cer sudo openssl x509 -text -in /var/lib/aziot/certd/certs/aziotedgedca-<GUID>.cer sudo openssl x509 -text -in /var/lib/aziot/certd/certs/deviceid-<GUID>.cer sudo openssl x509 -in /var/aziot/certs/IDevID.cert.pem -text | head -n 10 That’s it! When the time (80% to expiration) comes, IoT Edge will automatically renew both the device ID and the Edge CA certificates without manual intervention. Simplify IoT Edge Security This blog showed how to configure IoT Edge devices for secure communication using X.509 certificates without the need for manual certificate management. By using this approach, organizations can securely and efficiently manage their IoT Edge devices at scale, streamlining device enrollment and reducing the risk of security breaches. To adapt the example to fit your needs, consider the following: Security level: Your security requirements may vary based on your use case. Consider whether a unique IDevID certificate per device is necessary or if sharing the same certificate among multiple devices is acceptable. It's important to never store the initial EST secret value on the device in plaintext. Comprehensive security: For a more robust security approach, refer to The blueprint to securely solve the elusive zero-touch provisioning of IoT devices at scale | Azure. Dev/test scenarios: IoT Edge also supports basic authentication (username/password) for EST servers. To Restart If you need to restart midway through, stop the IoT Edge service first, delete any certificates and keys that were generated, reapply the config, and restart IoT Edge. sudo iotedge system stop sudo sh -c "rm /var/lib/aziot/certd/certs/*" sudo sh -c "rm /var/lib/aziot/keyd/keys/*" sudo cp config.toml /etc/aziot/config.toml sudo iotedge config apply sudo iotedge system logs -- -f
