> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Create an Azure IoT Project

> Create an Azure IoT project that links your nodes to Azure DPS and IoT Hub, choose Symmetric Key, X.509, or TPM enrollment, and deploy IoT Edge runtime.

## Introduction

An Azure IoT project is a special project type in Edge Infrastructure Services that integrates your nodes with Microsoft Azure IoT Hub. When you add a node to an Azure IoT project, Edge Infrastructure Services registers the node with your Azure Device Provisioning Service (DPS), provisions Azure credentials on the node, and deploys the Azure IoT Edge runtime application automatically based on the project's application policy.

Azure IoT projects support the following enrollment types:

* **Symmetric Key**: Uses a group enrollment in Azure DPS. The enrollment group name must be provided during project creation.
* **X.509**: Uses certificate-based authentication with Azure DPS.
* **TPM**: Uses the node's Trusted Platform Module for hardware-based attestation. Allocation is handled by IoT Hub using a hashed scheme.

### Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* You have an active Microsoft Azure subscription with the following resources configured:
  * An Azure Active Directory application registration with a client ID and secret.
  * An Azure IoT Hub.
  * An Azure Device Provisioning Service (DPS) linked to the IoT Hub.
  * For Symmetric Key and X.509 enrollment: a DPS enrollment group.
  * For certificate-based leaf device communication: an intermediate or root CA certificate and its private key.
* See [Azure IoT Hub Reference Prerequisites](#azure-prerequisites) for links to the Azure documentation for each of these setup steps.

## How It Works

When you create an Azure IoT project and add nodes to it, Edge Infrastructure Services performs the following steps:

1. EVE-OS (Edge Virtualization Engine) on the node contacts the Azure DPS endpoint.
2. DPS authenticates the device using the configured attestation type and assigns it to the linked IoT Hub.
3. Edge Infrastructure Services deploys the Azure IoT Edge runtime application to the node based on the project's application policy.
4. Module policies in the project define which Azure IoT Edge modules are deployed to the node, in what priority order, and based on which device tags.

## Create an Azure IoT Project

1. In the sidebar, go to **Infrastructure > Fleet > Projects**.

2. Select the **+** icon to start project creation.

3. On the project type selection screen, click **Azure IoT**.

4. Complete the **Identity** section:

   | Field | Description |
   | - | - |
   | **Name** | A unique identifier for the project within the enterprise. The name cannot be changed after creation. |
   | **Title** | A display name for the project. |
   | **Description** | Optional. A description of the project's purpose. |

5. In the **Azure Portal Integration** section, click **Login to Azure**. Enter your Azure credentials when prompted. After a successful login, Edge Infrastructure Services discovers and populates the available Azure resources.

6. In the **Azure Client Details** section, provide:

   | Field | Description |
   | - | - |
   | **Application (client) ID** | The Application ID assigned when you registered your app in Azure Active Directory. |
   | **Client secret** | The application password for the Azure AD app registration. |

7. In the **Discovered Azure Resources** section, select or confirm the following:

   | Field | Description |
   | - | - |
   | **Directory (tenant) ID** | Populated automatically from your Azure login session. |
   | **Attestation type** | Select **Symmetric Key**, **X.509**, or **TPM**. |
   | **Subscription** | The Azure subscription that contains the IoT Hub and DPS. |
   | **Resource group** | The resource group for the DPS and IoT Hub. |
   | **Device Provisioning Service** | The DPS instance to use for device enrollment. |
   | **IoT Hub** | The IoT Hub to which the DPS will assign enrolled devices. |
   | **Enrollment group** | For Symmetric Key and X.509: the enrollment group defined in the DPS. For TPM, this field is replaced by **IoT Hub Allocation Scheme**, which is set to **Hashed** automatically. |

8. Optional: enable **Attach certificate for Edge hub TLS (downstream devices and modules)**. Upload a root or intermediate CA certificate and its private key. This is required if IoT Edge acts as a transparent gateway for downstream leaf devices or edge modules. See [Manage Azure IoT Certificates](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-certificate-management.md) for details.

9. Optional: expand **Additional Configuration** and adjust the following settings:

   | Field | Description |
   | - | - |
   | **Project Tags** | Key:value pairs to classify the project. Enter each tag and press Enter or comma to add it. |
   | **Network Flow Log** | Enable to capture network flow statistics for nodes in the project. |
   | **Interface Ordering** | Enable to keep the adapter order of application instances consistent across nodes in the project. |
   | **Suppress Streaming Telemetry** | Enabled by default. Disable to receive streaming telemetry from nodes in the project. |

10. Click **Next**.

11. On the **Review** page, verify the project configuration.

12. Click **Create Project**.

The project appears in the Projects list with status **Initialized** until the first application policy takes effect. Status changes to **Ready** when the project is ready for use.

## Configure Azure IoT Policies

After creating the project, you can configure additional settings from the project detail page:

* **Edge app policy**: Defines which Azure IoT Edge runtime application is automatically deployed to nodes that join the project. Open the project and click the **Configure** (gear) icon to set or update the edge app policy.
* **Module policies**: Define which Azure IoT Edge modules are deployed to nodes, in what priority order, and based on which device tags. Module policies are created in Azure IoT Hub and appear automatically in Edge Infrastructure Services. See [Manage Azure Module Policies](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-module-policies.md) for details.

## Edit an Azure IoT Project

1. In the sidebar, go to **Infrastructure > Fleet > Projects** and click the project name to open its detail page.
2. Click the **Configure** (gear) icon.
3. Update the editable fields. The project name cannot be changed.
4. To replace the attached certificate, remove the existing certificate and upload the new one.
5. Click **Save**.

## Delete an Azure IoT Project

1. In the sidebar, go to **Infrastructure > Fleet > Projects**.
2. Select the checkbox for the project you want to delete.
3. Click the **Delete** action.
4. Confirm the deletion.

Deleting a project does not remove the nodes that were members of it, but it stops the automatic deployment of the project's application policy to new nodes.

## Azure Prerequisites

If you do not yet have the required Azure resources, set them up using the following Microsoft documentation:

* [Create an Azure subscription](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/subscriptions/).
* [Create a resource group](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal#create-resource-groups).
* [Create an IoT Hub](https://docs.microsoft.com/en-us/azure/iot-hub/).
* [Create an IoT Hub Device Provisioning Service (DPS)](https://docs.microsoft.com/en-us/azure/iot-dps/).
* [Link your IoT Hub and DPS](https://docs.microsoft.com/en-us/azure/iot-dps/quick-setup-auto-provision#link-the-iot-hub-and-your-device-provisioning-service).
* [Create an Azure Active Directory app registration with service principal access](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal).
* [Create a private container registry (for custom module images)](https://docs.microsoft.com/en-us/azure/container-registry/).

## Next Steps

> [card] [Manage Azure IoT Certificates](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-certificate-management.md)
>
> Upload signing certificates and manage the device CA certificate lifecycle for IoT Edge hub TLS.

> [card] [Manage Azure Module Policies](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-module-policies.md)
>
> View and manage module deployment policies applied to the project from Azure IoT Hub.

> [card] [Deploy an Azure IoT Application](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation/azure-iot-app-deployment.md)
>
> Deploy the Azure IoT Edge runtime application to an enrolled node.

> [card] [Integrations and Automation](https://zededa.mintlify.site/new-ui/infrastructure-services/integrations-and-automation.md)
>
> Overview of all integration paths available in Edge Infrastructure Services.