Here’s the complete implementation architecture for automated device onboarding with asset management integration:
DPS Enrollment Groups Configuration:
We created enrollment groups organized by device type and location:
enrollment_group = {
"enrollmentGroupId": "production-sensors-us-east",
"attestation": {
"type": "x509",
"x509": {
"signingCertificates": {
"primary": ca_certificate
}
}
},
"allocationPolicy": "custom",
"customAllocationDefinition": {
"webhookUrl": allocation_function_url,
"apiVersion": "2019-03-31"
}
}
Custom Allocation Function Implementation:
The Azure Function handles device provisioning logic:
def allocation_handler(provisioning_request):
device_id = provisioning_request['deviceId']
registration_id = provisioning_request['registrationId']
# Extract device metadata from attestation
device_metadata = parse_device_certificate(
provisioning_request['attestation']
)
# Query asset management system
asset_info = asset_mgmt_api.lookup_device(
device_id=device_id,
serial_number=device_metadata['serial']
)
# Determine IoT Hub based on location
iot_hub = select_hub_by_location(asset_info['location'])
# Assign device role based on asset type
device_role = determine_role(asset_info['asset_type'])
# Create asset record
asset_mgmt_api.create_or_update_asset(
asset_id=asset_info['asset_id'],
device_id=device_id,
provisioning_status='active'
)
# Return allocation with initial twin configuration
return {
"iotHubHostName": iot_hub,
"initialTwin": {
"tags": {
"assetId": asset_info['asset_id'],
"location": asset_info['location'],
"deviceRole": device_role
},
"properties": {
"desired": {
"rolePermissions": get_role_permissions(device_role),
"assetManagementEndpoint": asset_mgmt_config['endpoint']
}
}
}
}
Custom Role Assignment Logic:
Roles determine device operational permissions:
- Sensor Role: Telemetry send only, no command reception
- Actuator Role: Command reception, telemetry send, limited configuration
- Gateway Role: Full device management, command relay, telemetry aggregation
Role permissions are set in device twin desired properties and enforced by device firmware and backend services.
Integration with Asset Management:
Bidirectional synchronization between IoT Hub and asset management:
- Provisioning → Asset Creation: Handled by allocation function
- Asset Updates → Device Twin: Event Grid subscription on asset management changes triggers Azure Function to update device twin
- Device Twin Changes → Asset Updates: IoT Hub device twin change events trigger asset management updates
Error Handling and Resilience:
Implemented multi-layer fault tolerance:
- Retry logic with exponential backoff for API calls
- Circuit breaker pattern for asset management API
- Fallback provisioning with default role if asset lookup fails
- Reconciliation queue for deferred asset creation
- Dead letter queue for permanently failed provisions
Device Replacement Handling:
When hardware is replaced:
- Old device is deregistered from IoT Hub
- Asset record is updated with replacement timestamp and reason
- New device provisioning includes “replacementFor” metadata
- Allocation function links new device to existing asset
- Historical device associations maintained for audit
Results and Benefits:
- Onboarding time reduced from 30-45 minutes to under 2 minutes
- Zero manual intervention required for standard devices
- 100% accuracy in role assignment (previously 15% error rate)
- Complete audit trail of device-asset associations
- Scalability to onboard hundreds of devices simultaneously
This architecture provides fully automated, scalable device onboarding while maintaining tight integration with enterprise asset management systems.