Set up a managed root and intermediate CA (preview)

This article explains how to create root and intermediate certificate authorities within your Azure Device Registry namespace. Use this workflow if you want Azure Device Registry to provision certificate authorities in Microsoft cloud PKI on your behalf.

Important

Azure IoT Hub with Azure Device Registry integration and Microsoft-backed X.509 certificate management is in public preview and isn't recommended for production workloads. For more information, see FAQ: What is new in IoT Hub?.

For information about how the root and intermediate CAs establish trust, see CA hierarchy in Azure Device Registry.

Prerequisites

Before you begin, make sure you have:

An active Azure subscription. If you don't have one, create a free account.
An existing Azure Device Registry namespace. For setup instructions, see Deploy Azure IoT Hub with ADR integration and certificate management.
Permission to manage certificate authorities and policies in the namespace, such as the Azure Device Registry Credentials Contributor role.

Set up the certificate authorities

Use the Azure portal or Azure CLI to create root and intermediate certificate authorities.

Azure portal
Azure CLI

Create a root CA

In the Namespaces list, select your namespace.
Under Security, select Certificate Authorities.
Select Create. Root Certificate Authority is disabled if the namespace already has one root CA by default.
Select Root Certificate Authority.
Give the certificate authority a name that is 3-63 characters in length, then select Create.
Wait for Azure to finish provisioning the root CA. When provisioning is complete, the resource appears on the Certificate Authorities page.

Create an intermediate certificate authority

On the Certificate Authorities page, select Create.
Select Intermediate Certificate Authority.
Select Use this namespace's Root CA, enter a name for the intermediate CA, and then select Create. After you create an intermediate CA, you must create a certificate policy before you can issue device certificates. For instructions, see Create or edit a certificate policy.

Prepare the Azure CLI

Install Azure CLI. To check the installed version, run az version. To install the latest version, run az upgrade.
Sign in to Azure by running az login.
Install the azure-iot extension when prompted on first use. To update an existing installation, run az extension update --name azure-iot.

Set variables

Optionally, define variables for the commands in this article.

RG_NAME="<resource-group>"
NS_NAME="<adr-namespace>"

Create the root CA

Run the following command to enable certificate management and provision a root CA for the namespace:

az iot adr ns ca create --name "<root-ca-name>" --ns "$NS_NAME" --resource-group "$RG_NAME" --subscription <subscription_id> --location <region> --type Root

Verify that provisioning succeeded and review the root CA certificate information:

az iot adr ns ca show --name "<root-ca-name>" --namespace "$NS_NAME" --resource-group "$RG_NAME"

Create an intermediate CA

Create an intermediate certificate authority that's issued by the namespace root CA.

az iot adr ns ca create --name "<ica-name>" --ns "$NS_NAME" --resource-group "$RG_NAME" --subscription <subscription_id> --location <location> --type ICA --issuer-type Microsoft --issuer-ca-name "<root-ca-name>"

Verify that the intermediate certificate authority properties match the values that you specified:

az iot adr ns ca show --ca-name "<ica-name>" --ns "$NS_NAME" --resource-group "$RG_NAME" --subscription <subscription_id>

After you create an intermediate CA, you must create a certificate policy before you can issue device certificates. For instructions, see Create or edit a certificate policy.

Feedback

Was this page helpful?

Last updated on 2026-10-15