Azure / Azure/azure-rest-api-specs

Azure IoT DPS should support disabling local authentication / Shared Access Key authentication

Open
#45,877 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

### API Spec link

https://global.azure-devices-provisioning.net/[ID_Scope]/registrations/[registration_id]/register?api-version=2021-06-01

### API Spec version

2021-06-01

### Describe the bug

Azure IoT Hub supports disabling local authentication through the disableLocalAuth/local_authentication_enabled setting.

However, Azure IoT Device Provisioning Service (DPS) does not appear to expose an equivalent setting.

DPS automatically creates/maintains shared access policies and their associated keys, and there does not appear to be a way to disable SAS/shared-key authentication and require Microsoft Entra ID /managed identity authentication only.

This creates a problem for environments where the security requirement is to eliminate local authentication and long-lived shared access keys.

Request:
Please provide an equivalent of disableLocalAuth /localAuthenticationEnabled for Azure IoT DPS.

### Expected behavior

DPS automatically creates/maintains shared access policies and their associated keys, and there does not appear to be a way to disable SAS/shared-key authentication and require Microsoft Entra ID /managed identity authentication only.

### Actual behavior

DPS automatically creates/maintains shared access policies and their associated keys, and there does not appear to be a way to disable SAS/shared-key authentication and require Microsoft Entra ID /managed identity authentication only.

### Reproduction Steps

Delete the default shared access and wait a few seconds; it will reappear again.

### Environment

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the linked Azure IoT DPS API specification and compare its settings with the described IoT Hub disableLocalAuth/localAuthenticationEnabled behavior. Confirm whether the 2021-06-01 DPS API exposes a corresponding property, then identify the specification changes and validation needed to support disabling SAS/shared-key authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authentication, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.