Manage Azure Module Policies

​

Introduction

When an Azure IoT Edge device (node) enrolls in an Azure IoT project, it runs at minimum two system modules: the edge agent module twin and the edge hub module twin. To deploy additional custom modules to enrolled nodes, you define module policies (deployment manifests) in Azure IoT Hub. A module policy is a JSON deployment manifest that describes:

• The container image for each module to run on the device.
• The credentials to access private container registries.
• The desired properties of each module twin.
• The routing rules that control how messages flow between modules and to IoT Hub.

Module policies are created and managed in Azure IoT Hub. After they are applied to an Azure IoT project, they appear automatically in Edge Infrastructure Services on the project’s Modules tab.

​

Prerequisites

• You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
• An Azure IoT project exists and has module policies applied to it from Azure IoT Hub. See Create an Azure IoT Project.

​

Manage Module Policies in Edge Infrastructure Services

After module policies are applied to your project in Azure IoT Hub, you can view, rename, and remove them in the Edge Infrastructure Services console.

​

View module policies

1. In the sidebar, go to Infrastructure > Fleet > Projects and click the project name.
2. Click the Configure (gear) icon to open the project settings.
3. Select the Modules tab.

Each policy in the list shows its name and the number of modules defined in its manifest.

​

Rename a module policy

Renaming a policy in Edge Infrastructure Services changes only the local display name. It does not change the policy name in Azure IoT Hub.

1. In the sidebar, go to Infrastructure > Fleet > Projects and click the project name.
2. Click the Configure (gear) icon to open the project settings.
3. Select the Modules tab.
4. Click Edit next to the policy you want to rename.
5. Enter the new name and click Save.

​

Remove a module policy

Removing a module policy from the project in Edge Infrastructure Services does not automatically remove the modules it deployed from the nodes. See Module Policy Scenarios for approaches to deprovision modules from a node.

1. In the sidebar, go to Infrastructure > Fleet > Projects and click the project name.
2. Click the Configure (gear) icon to open the project settings.
3. Select the Modules tab.
4. Click Remove next to the policy you want to remove.
5. Confirm the removal.

​

Module Policy Scenarios

The following scenarios describe common situations that arise when multiple module policies are in use.

​

Two module policies target the same node

If you define module policies Module-policy1 and Module-policy2 for the same node or group of nodes, but the modules from Module-policy1 remain active even after you apply Module-policy2, the cause is typically one of the following:

• Module-policy2 has a lower priority than Module-policy1.
• The tag condition on Module-policy2 does not match the node’s tags.

When a module policy is deleted in Edge Infrastructure Services, the modules it defines are not automatically removed from the node. This is by design in Azure IoT Hub’s manifest-based deployment model.

​

Remove a module from a node

To remove a specific module from a node, use one of the following approaches in Azure IoT Hub:

• Update the active module policy to remove the module from its deployment manifest.
• Create a new module policy with a higher priority than the currently applied policy, a correct matching tag, and a manifest that does not include the module to remove.
• Create a module policy with no modules defined and set its priority higher than the currently active policy. The new empty manifest is applied to the node (the edge agent and edge hub module twins remain on the node regardless).

​

Next Steps