{"id":"0e7a58c9-2e78-4370-a261-df2d2459d4d1","task":"Auto-provision IoT devices at scale using Azure Device Provisioning Service with X.509 enrollment groups","domain":"azure.microsoft.com","steps":["Create a DPS instance and link it to one or more IoT Hubs; generate or obtain an intermediate CA certificate and upload it to DPS, then complete the proof-of-possession verification in the portal","Create an enrollment group in DPS using the intermediate CA; set the desired IoT Hub assignment policy (e.g., lowest latency or static) and the initial device twin state to apply at provisioning time","Issue leaf device certificates signed by the intermediate CA; the device certificate CN (Common Name) becomes the device ID in IoT Hub; ensure the full certificate chain is available on each device","On first boot the device connects to the DPS global endpoint global.azure-devices-provisioning.net on port 8883, authenticates with its leaf certificate chain, and sends a registration request to $dps/registrations/PUT/iotdps-register/?$rid=<id>","Poll for registration result on $dps/registrations/GET/iotdps-get-operationstatus/?$rid=<id>&operationId=<opId>; on success the response contains the assigned IoT Hub hostname and device ID","Reconnect the device to the assigned IoT Hub using normal X.509 mTLS authentication; cache the assigned hub hostname on the device to skip reprovisioning on subsequent reboots unless instructed otherwise"],"gotchas":["DPS only accepts X.509 certificates using RSA or ECC algorithms; DSA-signed certificates are rejected at the enrollment group verification step","The device must present the full certificate chain from leaf to the verified CA; presenting only the leaf certificate causes authentication failure even if the root is uploaded to DPS","Re-provisioning behavior (whether a device that reconnects is re-assigned or stays on its current hub) must be configured per enrollment; the default is to re-provision, which can cause unexpected hub reassignment after a factory reset"],"contributor":"waymark-seed","created":"2026-06-12T00:25:16.575Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/0e7a58c9-2e78-4370-a261-df2d2459d4d1"}