iotHubs
Summary
Details
Device Identities are exported to a secondary region
Impact: High Category: Disaster Recovery
APRL GUID: 783c6c18-760b-4867-9ced-3010a0bc5aa3
Description:
Device Identities should be copied to the failover region IoT Hub for all IoT devices to ensure connectivity in case of a failover. Manual Failover to another region is quicker (RTO), suitable for mission critical workloads.
Potential Benefits:
Faster failover; Ensures device connectivity
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// cannot-be-validated-with-arg
Do not use free tier
Impact: High Category: High Availability
APRL GUID: eeba3a49-fef0-481f-a471-7ff01139b474
Description:
In a production scenario, the IoT Hub tier should not be Free because the Free tier does not provide the necessary Service Level Agreement.
Potential Benefits:
Ensures SLA for production
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// Azure Resource Graph Query
// list all IoT Hubs that are using the Free tier
resources
| where type =~ "microsoft.devices/iothubs" and
tostring(sku.tier) =~ 'Free'
| project recommendationId="eeba3a49-fef0-481f-a471-7ff01139b474", name, id, tags, param1=strcat("tier:", tostring(sku.tier))
Use Availability Zones
Impact: High Category: High Availability
APRL GUID: 214cbc46-747e-4354-af6e-6bf0054196a5
Description:
In regions supporting Availability Zones for IoT Hub, using these zones boosts availability. They're automatically activated for new IoT Hubs in supported areas.
Potential Benefits:
Boosts IoT Hub availability
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// cannot-be-validated-with-arg
Use Device Provisioning Service
Impact: High Category: Scalability
APRL GUID: b1e1378d-4572-4414-bebd-b8872a6d4d1c
Description:
Device Provisioning Service (DPS) enables easy redistribution of IoT devices for scaling and availability, allowing devices to be reassigned and not bound to specific IoT Hub instances. Devices in IoT Hubs using DPS should be verified for DPS utilization.
Potential Benefits:
Enhances scalability and availability
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// Azure Resource Graph Query
// list all IoT Hubs that do not have a linked IoT Hub Device Provisioning Service (DPS)
resources
| where type =~ "microsoft.devices/iothubs"
| project id, iotHubName=tostring(properties.hostName), tags, resourceGroup
| join kind=fullouter (
resources
| where type == "microsoft.devices/provisioningservices"
| mv-expand iotHubs=properties.iotHubs
| project iotHubName = tostring(iotHubs.name), dpsName = name, name=iotHubs.name
) on iotHubName
| where dpsName == ''
| project recommendationId="b1e1378d-4572-4414-bebd-b8872a6d4d1c", name=iotHubName, id, tags, param1='DPS:none'
Define Failover Guidelines
Impact: High Category: High Availability
APRL GUID: 02568a5d-335e-4e51-9f7c-fe2ada977300
Description:
In case of a regional failure, an IoT Hub can failover to a second region, automatically or manually, to ensure your application continues working.
Potential Benefits:
Ensures business continuity
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// cannot-be-validated-with-arg
Disabled Fallback Route
Impact: Low Category: Monitoring and Alerting
APRL GUID: e7dbd21f-b27a-4b8c-a901-cedb1e6d8e1e
Description:
Using message routing for custom endpoints in IoT Hub, messages might not reach these destinations if specific conditions are unmet. A default route ensures all messages are received, but disabling this safety net risks leaving some messages undelivered.
Potential Benefits:
Prevents undelivered messages
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// Azure Resource Graph Query
// list all IoT Hubs that have the fallback route disabled
resources
| where type == "microsoft.devices/iothubs"
| extend fallbackEnabled=properties.routing.fallbackRoute.isEnabled
| where fallbackEnabled == false
| project recommendationId="e7dbd21f-b27a-4b8c-a901-cedb1e6d8e1e", name, id, tags, param1='FallbackRouteEnabled:false'