Provision and Manage Devices
What you must know
Devices authenticate to IoT Hub with SAS tokens (symmetric keys) or X.509 certificates. Understand the SAS token structure: resource URI, expiry, and signature computed with the device key. Know that shared access signatures expire and devices must renew them, while X.509 certificates allow long-lived trust chains. Understand the device registry: device identity, twin, and the difference between a device twin (desired and reported properties, tags) and a module twin.
Know DPS enrolment: individual enrolments versus enrolment groups, attestation by symmetric key, TPM, or X.509, and the reprovisioning policy (never, reprovision and migrate, initial assignment only). Know automatic device management with device twin configurations and IoT Edge automatic deployments.
Traps
- Confusing desired properties (set by the back end) with reported properties (set by the device).
- Assuming a deleted device identity removes its twin data instantly - cleanup is asynchronous.
- Mixing up individual enrolment (one device) with enrolment group (many devices sharing an attestation mechanism).
- Forgetting that a SAS token expiry must be in the future and within the hub's allowed window.
- Assuming tags are visible to the device - tags are back-end only.
Rule of thumb
If the stem says "thousands of devices with the same attestation method", choose an enrolment group. If it says "one device with a unique TPM endorsement key", choose an individual enrolment.
Worked example
A factory ships 10,000 identical sensors, each with a unique symmetric key derived from a group key. The answer is a DPS enrolment group with symmetric key attestation, not 10,000 individual enrolments, because the group key can derive per-device keys.