Export data to a secure destination on an Azure Virtual Network

Data export in IoT Central lets you continuously stream device data to destinations such as Azure Blob Storage, Azure Event Hubs, Azure Service Bus Messaging. You may choose to lock down these destinations by using an Azure Virtual Network (VNet) and private endpoints.

Currently, it's not possible to connect an IoT Central application directly to VNet for data export. However, because IoT Central is a trusted Azure service, it's possible to configure an exception to the firewall rules and connect to a secure destination on a VNet. In this scenario, you typically use a managed identity to authenticate and authorize with the destination.

Prerequisites

Configure the destination service

To configure Azure Blob Storage to use a VNet and private endpoint see:

To configure Azure Event Hubs to use a VNet and private endpoint see:

To configure Azure Service Bus Messaging to use a VNet and private endpoint see:

Configure the firewall exception

To allow IoT Central to connect to a destination on a VNet, enable a firewall exception on the VNet to allow connections from trusted Azure services.

To configure the exception in the Azure portal for Azure Blob Storage, navigate to Networking > Firewalls and virtual networks. Then select Allow Azure services on the trusted services list to access this storage account.:

Screenshot from Azure portal that shows firewall exception for Azure Blob Storage virtual network.

To configure the exception in the Azure portal for Azure Event Hubs, navigate to Networking > Public access. Then select Yes to allow trusted Microsoft services to bypass this firewall:

Screenshot from Azure portal that shows firewall exception for Azure Event Hubs virtual network.

To configure the exception in the Azure portal for Azure Service Bus, navigate to Networking > Public access. Then select Yes to allow trusted Microsoft services to bypass this firewall:

Screenshot from Azure portal that shows firewall exception for Azure Service Bus virtual network.

Next steps

Now that you've learned how to export data to a destination locked down on a VNet, here's the suggested next step: