{"id":"0d3b7050-d877-482c-b135-ac41a63bd88a","task":"Provision devices to Azure IoT Hub using a DPS symmetric key enrollment group with derived per-device keys","domain":"iot","steps":["In your Device Provisioning Service instance, go to Manage enrollments > Add enrollment group and select Symmetric key as the attestation mechanism","Name the group, choose auto-generated or custom keys, link the target IoT hub(s) and allocation policy, then create the group — DPS generates a primary and secondary key for it","Assign each device a unique registration ID (e.g. derived from its MAC address or serial number)","Derive each device's own key by computing an HMAC-SHA256 hash of its registration ID using the enrollment group's primary key, e.g. via `az iot dps enrollment-group compute-device-key --key <group_primary_key> --registration-id <device_registration_id>`","Flash each device with only its ID Scope, registration ID, and derived key (never the group key) so it can attest with DPS and auto-provision to the linked IoT hub"],"gotchas":["Never embed the enrollment group's primary/secondary key in device firmware — only ship the per-device derived key; a leaked group key compromises every device in the group","Deleting an enrollment group does not delete its device registration records, which still count against the DPS registration quota — delete the registration records first","Registration IDs and enrollment group names are case-insensitive, up to 128 chars, limited to alphanumerics plus `- . _ :`, and must end in an alphanumeric or dash"],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/0d3b7050-d877-482c-b135-ac41a63bd88a"}