> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Deploy an Azure IoT Application

> Deploy the Azure IoT Edge runtime application to a node enrolled in an Azure IoT project using automatic or manual TPM-based deployment.

## Introduction

After creating an Azure IoT project and adding nodes to it, you deploy the Azure IoT Edge runtime application to each node. Edge Infrastructure Services supports two deployment modes:

* **Automatic**: The recommended method. Edge Infrastructure Services completes the full Azure integration without requiring you to interact with the Azure portal. When you configure an application policy in the Azure IoT project, the Azure IoT Edge runtime application is deployed automatically to every node added to the project.
* **Manual (TPM)**: Used when the enrollment type is TPM and the device must be individually enrolled in the Azure Device Provisioning Service (DPS) using its Trusted Platform Module endorsement key. This method requires toggling between the ZEDEDA console and the Azure portal.

This article covers the manual TPM-based deployment procedure.

### Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* An Azure IoT project exists and is configured with an application policy. See [Create an Azure IoT Project](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-iot-hub.md).
* The target node is onboarded to Edge Infrastructure Services.
* For manual TPM deployment: access to the Azure portal and the Azure Device Provisioning Service for the project.

## Automatic Deployment

Automatic deployment requires no steps beyond configuring the application policy in the Azure IoT project. When a node is added to the project, Edge Infrastructure Services automatically:

1. Registers the node with Azure DPS.
2. Provisions Azure IoT credentials on the node through EVE-OS (Edge Virtualization Engine).
3. Deploys the Azure IoT Edge runtime application to the node based on the project's application policy.

To use automatic deployment, ensure the project's **Edge App Policy** is configured when creating or editing the Azure IoT project. See [Create an Azure IoT Project](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-iot-hub.md) for the application policy fields.

## Manual TPM Deployment

The following procedure describes how to manually enroll a node in Azure DPS and deploy the Azure IoT Edge runtime application using TPM-based attestation.

### Copy the endorsement key from the node

1. In the sidebar, go to **Infrastructure > Fleet > Nodes**.
2. Click the name of the target node to open its detail page.
3. On the **Overview** tab, scroll to the **System & Security** section.
4. Hover over the **Hardware Security Module** row to open the details popover.
5. In the popover, click **Copy** next to **Endorsement Key**.

### Enroll the node in Azure DPS

1. Log in to the [Azure portal](https://portal.azure.com).
2. Search for and open your Device Provisioning Service (DPS) instance.
3. In the left navigation, select **Manage Enrollments**, then select **Individual Enrollments**.
4. Click **Add individual enrollment**.
5. In the **Add Enrollment** form:
   * Set the attestation mechanism to **TPM**.
   * In the **Endorsement Key** field, paste the key copied from the ZEDEDA console.
   * Enter a **Registration ID**.
6. Fill in any remaining required fields and click **Save**.
7. After the enrollment is saved, open it from the enrollment list.
8. From the DPS **Overview** section, copy the **ID Scope** value. Also note the registration ID and symmetric key for the next step.

### Deploy the application instance

The following procedure covers only the Azure IoT-specific steps. For a full walkthrough of the application instance creation wizard, see [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md).

1. In the sidebar, go to **Infrastructure > Workloads > Applications**.
2. Click **New Application**.
3. Complete the **App & Target** step:
   * Select the Azure IoT Edge runtime application image.
   * Select the target node.
4. Complete the **Interfaces** step.
5. In the **Custom Config** step, enter the following values:
   * **scope\_id**: the ID Scope value copied from the Azure DPS overview.
   * **registration\_id**: the registration ID.
   * **symmetric\_key**: the symmetric key.
6. Review the configuration and click **Deploy**.

Edge Infrastructure Services deploys the Azure IoT Edge runtime application to the selected node. A notification confirms that the application instance has been added. The instance appears in the Applications list with its current run state.

## Verify the Deployment

1. In the sidebar, go to **Infrastructure > Workloads > Applications**.
2. Locate the newly deployed application instance in the list.
3. Confirm the run state is **Online**.
4. If the instance does not reach **Online** within a few minutes, check the application instance events for error details.

For all possible run states and their meanings, see [Application Instance Details](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/app-instance-details.md#run-states).

## Next Steps

> [card] [Manage an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/manage-an-application-instance.md)
>
> View, configure, and manage running application instances.

> [card] [Manage Azure IoT Certificates](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-certificate-management.md)
>
> Configure and renew certificates for IoT Edge hub TLS communication.

> [card] [Manage Azure Module Policies](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-module-policies.md)
>
> View and manage Azure IoT Edge module deployment policies for the project.