Azure Device Provisioning Service with custom allocation policy function - how do add authentication?

Wojciech Mizera 5

I am using Azure Device Provisioning Service with custom allocation policy with Azure function.

I would like to introduce some kind of authentication for the function. The function is also used by other Azure services so I was thinking to have a managed identity for it, but I am not sure how DPS can use that identity.

I found how I can control access to the DPS, but how can I control access from DPS to the Azure Function? I didn't find anything useful in the documentation, only basic examples how to setup DPS with Azure Function, but nothing about authentication between the two.

If not managed identity, is there any other way to introduce authentication between DPS and custom allocation policy Azure function?

AshokPeddakotla-MSFT 27,296 Reputation points

2023-05-25T11:31:57.43+00:00

Wojciech Mizera Greetings!
Did you check this already Control access to Azure IoT Hub Device Provisioning Service (DPS) with shared access signatures and security tokens ?
Wojciech Mizera 5 Reputation points

2023-05-25T11:43:09.3466667+00:00
Hi @AshokPeddakotla-MSFT
Unfortunately the article describes how to restrict access to the DPS, while I am looking for ways to add authentication to Azure Function that serves as a custom allocation policy of one of the DPS enrollment groups.

Here's my setup:

FunctionApp

function Foo

function Bar

The DPS makes use of function Foo to determine to which IoT Hub a device should be assigned to.

Function Bar is used elsewhere and also should be protected.

I want to add managed identity to the FunctionApp to restrict access to both Foo and Bar functions, however I don't know how to give the DPS access to the identity, so that it can continue to use Foo as the allocation policy.
Wojciech Mizera 5 Reputation points

2023-05-25T11:48:23.32+00:00
Hi @AshokPeddakotla-MSFT
Unfortunately the article describes how to restrict access to the DPS, while I am looking for ways to add authentication to Azure Function that serves as a custom allocation policy of one of the DPS enrollment groups.

Here's my setup:

FunctionApp

function Foo

function Bar

The DPS makes use of function Foo to determine to which IoT Hub a device should be assigned to.

Function Bar is used elsewhere and also should be protected.

I want to add managed identity to the FunctionApp to restrict access to both Foo and Bar functions, however I don't know how to give the DPS access to the identity, so that it can continue to use Foo as the allocation policy.