Deploy an Azure IoT Application

​

Introduction

After creating an Azure IoT project and adding nodes to it, you deploy the Azure IoT Edge runtime application to each node. Edge Infrastructure Services supports two deployment modes:

• Automatic: The recommended method. Edge Infrastructure Services completes the full Azure integration without requiring you to interact with the Azure portal. When you configure an application policy in the Azure IoT project, the Azure IoT Edge runtime application is deployed automatically to every node added to the project.
• Manual (TPM): Used when the enrollment type is TPM and the device must be individually enrolled in the Azure Device Provisioning Service (DPS) using its Trusted Platform Module endorsement key. This method requires toggling between the ZEDEDA console and the Azure portal.

This article covers the manual TPM-based deployment procedure.

​

Prerequisites

• You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
• An Azure IoT project exists and is configured with an application policy. See Create an Azure IoT Project.
• The target node is onboarded to Edge Infrastructure Services.
• For manual TPM deployment: access to the Azure portal and the Azure Device Provisioning Service for the project.

​

Automatic Deployment

Automatic deployment requires no steps beyond configuring the application policy in the Azure IoT project. When a node is added to the project, Edge Infrastructure Services automatically:

1. Registers the node with Azure DPS.
2. Provisions Azure IoT credentials on the node through EVE-OS (Edge Virtualization Engine).
3. Deploys the Azure IoT Edge runtime application to the node based on the project’s application policy.

To use automatic deployment, ensure the project’s Edge App Policy is configured when creating or editing the Azure IoT project. See Create an Azure IoT Project for the application policy fields.

​

Manual TPM Deployment

The following procedure describes how to manually enroll a node in Azure DPS and deploy the Azure IoT Edge runtime application using TPM-based attestation.

​

Copy the endorsement key from the node

1. In the sidebar, go to Infrastructure > Fleet > Nodes.
2. Click the name of the target node to open its detail page.
3. On the Overview tab, scroll to the System & Security section.
4. Hover over the Hardware Security Module row to open the details popover.
5. In the popover, click Copy next to Endorsement Key.

​

Enroll the node in Azure DPS

1. Log in to the Azure portal.
2. Search for and open your Device Provisioning Service (DPS) instance.
3. In the left navigation, select Manage Enrollments, then select Individual Enrollments.
4. Click Add individual enrollment.
5. In the Add Enrollment form:
   • Set the attestation mechanism to TPM.
   • In the Endorsement Key field, paste the key copied from the ZEDEDA console.
   • Enter a Registration ID.
6. Fill in any remaining required fields and click Save.
7. After the enrollment is saved, open it from the enrollment list.
8. From the DPS Overview section, copy the ID Scope value. Also note the registration ID and symmetric key for the next step.

​

Deploy the application instance

The following procedure covers only the Azure IoT-specific steps. For a full walkthrough of the application instance creation wizard, see Deploy an Application Instance.

1. In the sidebar, go to Infrastructure > Workloads > Applications.
2. Click New Application.
3. Complete the App & Target step:
   • Select the Azure IoT Edge runtime application image.
   • Select the target node.
4. Complete the Interfaces step.
5. In the Custom Config step, enter the following values:
   • scope_id: the ID Scope value copied from the Azure DPS overview.
   • registration_id: the registration ID.
   • symmetric_key: the symmetric key.
6. Review the configuration and click Deploy.

Edge Infrastructure Services deploys the Azure IoT Edge runtime application to the selected node. A notification confirms that the application instance has been added. The instance appears in the Applications list with its current run state.

​

Verify the Deployment

1. In the sidebar, go to Infrastructure > Workloads > Applications.
2. Locate the newly deployed application instance in the list.
3. Confirm the run state is Online.
4. If the instance does not reach Online within a few minutes, check the application instance events for error details.

For all possible run states and their meanings, see Application Instance Details.

​

Next Steps