Announcing new security enhancements across Azure IoT services

When it comes to connected products and solutions, security is key. It influences everything, from device setup to how they connect and get updates. As more devices come online and attackers explore new vulnerabilities, users are looking for enhanced security measures at every step of the process.

Today, we’re making substantial improvements in this area. Those managing connected devices will benefit from a modern security baseline featuring TLS 1.3 for Azure IoT Hub, identity-driven provisioning that eliminates the use of long-lived secrets through managed identity support for linking an IoT Hub to DPS, and encrypted update delivery via TLS downloads for Device Update for IoT Hub. At the moment, TLS 1.3 and managed identity are in Public Preview while TLS downloads are now Generally Available.

Azure IoT Hub now introduces TLS 1.3 through new endpoints alongside the traditional classic endpoint:

• Classic endpoint: .azure-devices.net

• TLS 1.3 Device endpoint: .device.azure-devices.net

• TLS 1.3 Service endpoint: .service.azure-devices.net

These new device and service endpoints support both TLS 1.3 and TLS 1.2 but with a limited selection of secure cipher suites. Devices connect using the device endpoint for telemetry from device-to-cloud and messages from cloud-to-device, while backend and management applications utilizing the service SDK connect through the service endpoint.

The classic endpoint will stay available, allowing customers to transition to the new endpoints at their pace, rather than feeling forced. There’s no need for any enabling action: the new endpoints are automatically provisioned on both new and existing hubs, and clients can access TLS 1.3 simply by pointing to the new hostnames.

TLS 1.3 provides a modern security standard for IoT connectivity. Moreover, this update offers a distinct separation between device and service traffic through dedicated endpoints, making the connectivity framework easier to grasp and develop over time.

This design mirrors real-world IoT implementations. Many users can’t update every device or backend integration simultaneously, so having both types of endpoints allows teams to test, verify, and implement changes gradually.

Discover more about the support for TLS 1.3 in Azure IoT Hub.

We’re also rolling out managed identity support for linking an IoT Hub to DPS. This allows DPS to connect securely to an IoT Hub, assigning devices to the correct hubs in bulk. Until now, this linkage depended on a connection-string (shared access key) system, requiring customers to maintain local authentication on the IoT Hub – even if their security guidelines dictated otherwise.

With managed identity support, this limitation is removed: DPS can now link to IoT Hub using a managed identity backed by Microsoft Entra ID, eliminating the need for a connection string. This enhancement allows customers to disable local authentication on the IoT Hub, remove long-lived shared keys from the provisioning pathway, and streamline credential management, reducing the risk of key leaks.

Combining TLS 1.3 and managed identity enhances the same Hub linking scenario. TLS 1.3 upgrades how devices and services connect with IoT Hub, while managed identity simplifies the authentication process during provisioning.

Learn more about how to link an IoT Hub to DPS using managed identity.

Device Update for IoT Hub now supports update content delivery over HTTPS, ensuring that update content is encrypted during transit from the Device Update service to your devices. For those managing extensive fleets, this aligns update delivery with the modern security standards now expected for device and service connectivity, plus it assists teams in meeting encryption-in-transit and compliance standards.

You can find download security under the deployment settings in the Device Update data plane API version 2026-06-01. New deployments created with this version will default to HTTPS, while existing deployments will continue with their current configuration. Customers needing HTTP downloads can still choose this option explicitly.

You can manage download security through the Azure portal during deployment creation, or by using the REST API, SDKs, Azure CLI, and automation workflows. Previous API versions only support HTTP downloads.

Before enabling HTTPS, make sure your devices are prepared. Devices need to support HTTPS downloads, trust the appropriate root certificate authorities, and be compatible with either TLS 1.2 or TLS 1.3. Some embedded devices may require code modifications; check additional considerations for constrained or embedded devices.

Learn more about secure downloads for Device Update for IoT Hub.

With these updates, Azure IoT services are taking significant strides toward secure, modern device onboarding, connectivity, and lifecycle management. TLS 1.3 enhances how devices and services connect, managed identity removes secrets from the provisioning process, and TLS download safeguards update content. Each element addresses a different aspect of the security framework, reflecting Microsoft’s ongoing commitment to security for the platforms our customers rely on.

Customers can start using TLS 1.3 for IoT Hub and managed identity for Hub linking in Preview today, and they can implement TLS downloads for Device Update right away.

Check out the documentation and share your feedback: