Configure access control roles for Device Update resources

In order for users to have access to Device Update, they must be granted access to the Device Update account, Instance and set the required access to the linked IoT hub.

Configure access control for Device Update account

Azure portal

1. In your Device Update account, select Access control (IAM) from the navigation menu.

   

2. Select Add role assignments.

3. On the Role tab, select a Device Update role from the available options:

   • Device Update Administrator
   • Device Update Reader
   • Device Update Content Administrator
   • Device Update Content Reader
   • Device Update Deployments Administrator
   • Device Update Deployments Reader

   For more information, Learn about Role-based access control in Device Update for IoT Hub.

   

4. Select Next

5. On the Members tab, select the users or groups that you want to assign the role to.

   

6. Select Review + assign

7. Review the new role assignments and select Review + assign again

8. You're now ready to use Device Update from within your IoT Hub

Azure CLI

The following roles are available for assigning access to Device Update:

• Device Update Administrator
• Device Update Reader
• Device Update Content Administrator
• Device Update Content Reader
• Device Update Deployments Administrator
• Device Update Deployments Reader

For more information, Learn about Role-based access control in Device Update for IoT Hub.

Use the az role assignment create command to configure access control for your Device Update account.

Replace the following placeholders with your own information:

• <role>: The Device Update role that you're assigning.
• <user_group>: The user or group that you want to assign the role to.
• <account_id>: The resource ID for the Device Update account that the user or group will get access to. You can retrieve the resource ID by using the az iot du account show command and querying for the ID value: az iot du account show -n <account_name> --query id.

az role assignment create --role '<role>' --assignee <user_group> --scope <account_id>

Configure access for Azure Device Update service principal in linked IoT hub

Device Update for IoT Hub communicates with IoT Hub to manage deployments and updates and to get information about devices. To enable the access, you need to give the Azure Device Update service principal access with the IoT Hub Data Contributor role.

Azure portal

1. In the Azure portal, navigate to the IoT hub connected to your Device Update instance.

   

2. Select Access Control(IAM) from the navigation menu. Select Add > Add role assignment.

   

3. In the Role tab, select IoT Hub Data Contributor. Select Next.

   **

4. For Assign access to, select User, group, or service principal. Select Select Members and search for 'Azure Device Update'

   

5. Select Next > Review + Assign

To validate that you've set permissions correctly:

1. In the Azure portal, navigate to the IoT hub connected to your Device Update instance.
2. Select Access Control(IAM) from the navigation menu.
3. Select Check access.
4. Select User, group, or service principal and search for 'Azure Device Update'
5. After clicking on Azure Device Update, verify that the IoT Hub Data Contributor role is listed under Role assignments

Azure CLI

Use the az role assignment create command to create a role assignment for the Azure Device Update service principal.

Replace <resource_id> with the resource ID of your IoT hub. You can retrieve the resource ID by using the az iot hub show command and querying for the ID value: az iot hub show -n <hub_name> --query id.

az role assignment create --role "IoT Hub Data Contributor" --assignee https://api.adu.microsoft.com/ --scope <resource_id>

Next steps

Try updating a device using one of the following quick tutorials:

• Update a simulated IoT Edge device
• Update a Raspberry Pi
• Update an Ubuntu Server 18.04 x64 Package agent