>> Hi. I am Sri Harsha. I'm a PM in the IoT Central team.
I'm here to talk about security.
In this session, I'm going to talk about
securing your IoT Central application, and
all the various avenues that IoT Central provides you to
secure access and connections to devices,
data, and the integrations.
When you think about security,
it's not an isolated concept,
but has to be embedded into all areas of the IoT solution.
That comes right from connecting your devices,
managing access to your device data within the application,
and to be able to securely connect
data to your data export destinations.
In this conversation, I'm going to talk about,
and also demonstrate some of the capabilities
that IoT Central provides you to
securely connect your devices to the Cloud using
private link, and manage your access control for
your devices and users within
the application using organizations,
and secure the connection to export destinations on
the far right by using managed identities.
How do you secure your data, or
devices connecting to IoT Central applications?
When you have your IoT Central application,
the endpoints are designed to be accessible from the public URLs.
Which means any device with valid access, and
valid identity can actually connect
your IoT Central application from any location.
To improve the security, though,
we might want to limit, and secure the device connectivity to
your IoT Central application, and only allow
devices to come into your private virtual network.
You can use the IoT Central's private
endpoint capabilities to achieve that goal.
You can create the IoT Central private endpoint to allow
devices within the virtual network,
or connecting to virtual network
to actually securely connect data, and
transmit data to IoT Central application, and to enable
that via directional communication
completely within your private virtual network.
I'm going to show a quick demo of this capablility in action.
On Azure portal,
we provide the capabilities to let you connect, or create
the private network destinations, and
the private network access to your IoT Central application.
On the Networking tab,
go to Private endpoint connections,
and here is where you'll create a private endpoint.
This involves a few steps here.
When I click ''Private endpoint''
I'm going to be giving a name to a private endpoint.
In this case, I'm giving it MyPE1.
I want it to be in the West US 3 region,
which has been all of my other resources.
When you click ''Next'' the results will be auto-created
for you because you're coming in from IoT Central application.
The next step is where you'll
actually associate the virtual network,
which is very delicate.
All the data remains in the virtual network for you.
When I click ''Create'' it's going to validate
my entire selections, and make
sure it's all validated for it to be created.
What it is doing right now is
it is actually creating all the resources that are
required for the IoT Central private endpoint to be created,
so that when it is done creating you'll have
a private endpoint that your devices can securely connect to.
Once the primary endpoint creation is done,
you'll go back to
the IoT Central application and on the Networking tab,
I can see the connection is all in place.
Now it's the time for me to go
disable public access on my IoT Central application.
All public access to this application is disabled by default,
and the only way to access or send data to
the IoT Central application is through the private endpoint.
So I will come here and hit ''Disable'' or I can even
choose the selected IP ranges if there
is selected IP ranges that I want to allow in.
But in this case, I want to disable
it completely from the Internet.
I'll click ''Disable'' and click ''Save.''
That's going to update the public Internet access for me.
Now, at this point,
the application is completely locked from the public Internet and
the only way to come in is through the virtual network here.
Now you've seen how do you secure
your device traffic coming in
from the Internet to the IoT Central application.
Now, let's talk about the data egress.
For the IoT solution,
you're not typically stopping at IoT Central,
you typically have the other data destinations
that you would want the same data to,
be it for your business situation needs,
for powering your business analytics workflows,
or long term storage or anything.
But when you have all of these resources you
have to deal with managing credentials for all of these resources.
Now, managing credentials for
other resources come up with their own set of challenges.
How do you securely store them?
How do you protect them so often?
Now, what's the best way for us to manage this problem?
Well, why don't we just eliminate the credential altogether?
IoT Central provides system assign managed identities.
Using the system assign managed identities,
you can securely connect to other Azure resources with
no credentials involved and there
are no secrets to store or manage.
Using managed identities have a lot of
benefits: You don't need to manage credentials,
those credentials are not even accessible to you,
you can use managed identities to authenticate to
any resource that supports Azure Active Directory authentication.
Best of all, there is no cost involved,
managed identities can be used without any additional cost.
Now I want to show it in action for you.
To set up managed identities,
you navigate your IoT Central application on the Azure portal,
go to the Identity tab and you send the video waiting to be on.
This does a few things.
This is going to enable
the managed identity for your IoT Central application,
which means your IoT Central application is going to
be registered on the Azure Active Directory as an object.
Now that you have an object Id for the IoT Central application,
you can now use this managed identity to authenticate to
other Azure destinations without needing to
actually exchange any credentials in the process.
In this example, I'm going to have a data export set up
to my Event Hub destination and I want to connect to
the Event Hub destination using this managed identity.
This is my Event Hub namespace here.
The first step is going to make sure that
IoT Central application has
permissions to send data to that Event Hub.
That's the beauty of managed identities here,
is that I don't have to
actually give all the permission that are needed,
I can use the beauty of
the Azure role-based access control to provide
granular permissions so that my IoT Central application has
only enough permission to send data to Event Hub and nothing else.
I'm going to add a role assignment.
The role I'm going to choose is called Event Hub Data Sender.
This role has only access to sending data into the Event Hubs.
On the next screen, I'm going to assign
access to the managed identity that I've just created.
Since this is a managed identity
it's not the Azure Active Directory,
it is actually going to be visible in the Active Directory space.
I'm going to system-assigned managed identities and select
my IoT Central application in this screen here.
When I review and assign
this permission
so my IoT Central applications
managed identity was assigned
Event Hubs to send data to the Event Hub.
Now I have a managed identity,
I have to make sure that I have given right permissions.
When you come back to your IoT Central application
to set up you can export destinations here.
In this case, I'll come to
my IoT Central application and set up my data export.
I'm going to be starting a new export and this is
my export for my data processing pipeline to the Event Hub.
I want to export deliberately,
and now I want to actually create a new destination,
which is that event Hub that I was going to be using.
I'm going to be creating a new destination,
this is a new Event Hub dime,
and instead of using
the connection string way of connecting directly to Event Hub,
I want to switch to using managed identities.
Here is where you can actually see that it's
no secret or credential management is
involved and there's no secret
that you're shooting with IoT Central.
I'll come back to Event Hub,
grab the name from the Event Hub,
which is what is really needed,
and the Event Hub that is in that Event Hub namespace.
When I click ''Create'' what you're going to see is that
IoT Central since it is restored with Azure Active Directory,
it is going to have access to the Event Hub
based on the role-based access already provided.
Now I would essentially disable to actually send
that Event Hub just using the managed identity.
It knows the credential that are involved in the process.
Now you can see the data export
to the destination using managed identities healthy,
and the export destination is continuously receiving the data
being sent by the devices to the IoT Central application.
Let me get back to my slides here.
Now if secured data coming into
IoT Central you have managed to
secure data going out of IoT Central.
What about the device data and user access
within IoT Central application.
The combination of role-based access control in
organizations provides a way for you to ensure
right people have access to right devices at
the right time by building multi-tenancy in your application.
How does organizations work?
You first get started by defining
this organizational structure within
your IoT Central application to organize
and to control your access of your own assets.
Once you have defined your organizational structure,
you will be able to assign devices to a given organization.
After you assign the devices to individual organizations,
you can also ensure some of the devices can remain
unassigned and they'll only be
accessible to you as an organization administrator.
When you have users,
you invite the users to your organizations.
When you actually invite a user,
you'll be asked to define
what organization they should have access to,
along with the role that you want to assign to that organization.
Single user can have access to
multiple organizations with different roles for each.
It's pretty flexible in that regard.
Lastly, as the users move across the IoT Central application,
access to different experiences like jobs,
roles, access, control,
everything will be scoped based on
the user's organizational access.
Let me actually show it to you in action.
In my IoT Central application Organizations are
under Permissions tab here.
You can see that I've created a hierarchy of
organizations for this application and also when I added users,
you can see that the users were given
specific roles in the specific organizations.
The same applies to everywhere.
When I add devices,
I can ensure the devices
are belonging to the organization when I assigned
the organization so the entire experiences
can follow along with the organizations.
In this example, you can see all the users here.
I'm going to be focusing on one user who is
an Org Administrator for a specific organization in the hierarchy.
If I switch to that user here,
you can see this user only has access
to the Building 17 Organization.
So all he can see are the devices that
belong to Building 17 and nothing else.
The same thing applies to other areas of the application as well.
When you go see the organizations,
the user can only see the organization that
he belongs to in the hierarchy offered,
the user cannot see all the
other applications in that application.
Similar to the users.
The user can only see the users belonging to
the same organization that he or she is in.
There's no way a user can actually
understand or see who else is in the application.
Similarly, for jobs,
the user can only see the jobs
that belong to the Building 17 Organization.
Similar to the device groups as well.
This organization concept follows the user across the application.
Using the combination of role-based access control in
organizations helps you to find
the access control within the application and be
able to actually do what might
be deemed operational within the application.
Thanks for watching this video.
Hope this was really useful for you.
Looking forward for you to
try out all the features of IoT Central.
To learn more about all of the capabilities,
visit our home page apps.azureiotcentral.com.
You can also visit aka.ms/IoTCentralDemos to
watch all the demonstrations of
IoT Central capabilities Thank you.