Auto-provision IoT devices at scale using Azure Device Provisioning Service with X.509 enrollment groups

Steps

1. Create a DPS instance and link it to one or more IoT Hubs; generate or obtain an intermediate CA certificate and upload it to DPS, then complete the proof-of-possession verification in the portal
2. Create an enrollment group in DPS using the intermediate CA; set the desired IoT Hub assignment policy (e.g., lowest latency or static) and the initial device twin state to apply at provisioning time
3. Issue leaf device certificates signed by the intermediate CA; the device certificate CN (Common Name) becomes the device ID in IoT Hub; ensure the full certificate chain is available on each device
4. On first boot the device connects to the DPS global endpoint global.azure-devices-provisioning.net on port 8883, authenticates with its leaf certificate chain, and sends a registration request to $dps/registrations/PUT/iotdps-register/?$rid=<id>
5. Poll for registration result on $dps/registrations/GET/iotdps-get-operationstatus/?$rid=<id>&operationId=<opId>; on success the response contains the assigned IoT Hub hostname and device ID
6. Reconnect the device to the assigned IoT Hub using normal X.509 mTLS authentication; cache the assigned hub hostname on the device to skip reprovisioning on subsequent reboots unless instructed otherwise