Azure IoT Hub Device Provisioning Service Scope ID

Question

Hi,

I have an existing IoT Hub DPS instance and need to move to new Azure subscriptions with the same DPS scope ID. Not sure if this possible and what are the impact /risks moving the existing DPS instance to new Azure tenant. Thanks

Answer 1

It is possible to move an IoT Hub Device Provisioning Service (DPS) instance to a new Azure subscription with the same DPS scope ID. However, there are some risks and impacts that you should be aware of before making the move.

Here is the repro of the scenario which i have tested to confirm on the initial query!

I see that the Scope ID is same: For the DPS after the move to new subscription.

Firstly, moving the DPS instance to a new subscription will cause downtime for your devices during the migration process. You will need to update your device configurations with the new endpoint information once the move is complete, which can take some time depending on the number of devices you have.

Secondly, you will need to ensure that all of the required Azure resources (such as IoT Hubs, storage accounts, and virtual networks) are set up in the new subscription before you begin the move. You may also need to update your access policies and firewall rules to allow access from the new subscription.

Finally, there may be some additional costs associated with moving your DPS instance to a new subscription, such as network egress charges or Azure Data Transfer fees.

To minimize the risks and impacts of moving your DPS instance, it is recommended that you carefully plan the migration process and test it thoroughly before making any changes in production. You should also consider working with a qualified Azure consultant or support team to ensure that the move is executed smoothly and efficiently.

Happy to help you further on this, please leave your comment in the below section for further section!

Answer 2

Hello @Erwin Bainto ,

As seen in eg. the CLI interface for manipulating one or more Azure Device provisioning services, it is not possible to change the ScopeID afterward.

If you want to move over to another DPS, you need to export/import all enrollment registrations of your devices first and then change the device security credentials: connection string, certificates, or TPM enrollments for each device.

The device can still exist on the IoT Hub and that registration will probably not change (please still test :-) ).

An alternative is moving the complete DPS service to another subscription as @Satish explains very well. Check his words about risk mitigation.

---

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.