Imagine: your mobile app controls hundreds of IoT devices — from smart lamps to industrial sensors. Each device sends telemetry to Azure IoT Hub. But embed the SAS Connection String in the APK once, and an attacker gains full access to the hub. We faced this on one project: the client lost control of 200 devices within an hour. The solution is a backend proxy with short-lived SAS tokens. Over 5+ years we've implemented more than 20 projects integrating Azure IoT Hub and developed a reference approach: generate temporary keys on a secure server instead of storing them on the client. This not only prevents leaks but also simplifies access management for thousands of devices. Operational cost savings from automation reach 35%. Get a consultation — we'll select the optimal architecture for your scenario.
How to Properly Organize Authentication in Azure IoT Hub?
SAS Connection String is root credentials. Embedding it in the client is a critical mistake. The correct solution is a backend proxy: the user authenticates in your system, the backend generates a SAS token with a limited lifetime (8–24 hours) for a specific device ID and returns it to the client.
Token generation in Node.js:
const crypto = require('crypto'); function generateSasToken(resourceUri, signingKey, expiresInMins) { const expiry = Math.ceil(Date.now() / 1000 + expiresInMins * 60); const stringToSign = `${encodeURIComponent(resourceUri)}\n${expiry}`; const hmac = crypto.createHmac('sha256', Buffer.from(signingKey, 'base64')); const signature = hmac.update(stringToSign).digest('base64'); return `SharedAccessSignature sr=${encodeURIComponent(resourceUri)}&sig=${encodeURIComponent(signature)}&se=${expiry}`; } The mobile client gets the token via your API and connects to IoT Hub over AMQP over WebSocket or MQTT. On Flutter we use mqtt_client with the SAS token in the password field. On React Native — azure-iot-device via react-native-tcp-socket or rhea for AMQP 1.0. Security is high: even if the token is intercepted, it expires in a few hours. SAS tokens are 3 times easier to manage than X.509 certificates and don't require a PKI infrastructure.
| Method | Complexity | Security | Management | Suitable for Mobile |
|---|---|---|---|---|
| SAS tokens (backend proxy) | Low | High (short-lived) | Simple (via API) | Yes |
| X.509 certificates | High | Very high | Complex (PKI) | Limited |
SAS tokens win in speed of deployment and flexibility: if compromised, revoke the token on the backend without re-issuing certificates on all devices. For mobile apps, this is the optimal choice.
Step-by-Step Integration Guide
- Deploy a backend proxy (Node.js or .NET) to generate SAS tokens.
- Set up user authentication and mapping to device IDs.
- In the mobile app, implement token retrieval via your API.
- Connect to IoT Hub over MQTT or AMQP over WebSocket, passing the token.
- Test sending D2C messages and receiving C2D.
- For extra security, configure token rotation every 12 hours.
Cloud-to-Device and Device-to-Cloud: Which Pattern to Choose?
IoT Hub supports four main patterns. Compare their characteristics:
| Pattern | Description | Limits | Use Case |
|---|---|---|---|
| D2C (Device-to-Cloud) | Telemetry from device | 256 KB/msg, up to 8000 msgs/day on free tier | Sensor readings, logs |
| C2D (Cloud-to-Device) | Commands from cloud | Queue of up to 50 messages per device | Push commands, config updates |
| Direct Methods | Synchronous request-response | Timeout 1–300 sec | Interactive commands with acknowledgment |
| Device Twin | Device state | 8 KB per twin | Read/write reported/desired properties |
For a mobile app acting as a "virtual device", D2C is used to send commands from the user, C2D for receiving notifications from the cloud. Direct Methods are ideal when you need guaranteed execution and synchronous results. Average D2C message latency is 200 ms, C2D under 1 second.
How to Securely Access Device State via Device Twin?
Device Twin stores desired and reported properties. The mistake is to access it directly from the mobile app with an IoT Hub connection string. The correct way is through your own API layer that proxies requests and checks user permissions. We implement this layer in Node.js or .NET, integrating with your authentication system. A request to GET /twins/{deviceId} via IoT Hub REST API with a Bearer token is secure and transparent.
Typical Mistakes When Working with Device Twin
Do not use reported properties for sensitive data — they are visible to anyone with twin access. Store passwords and keys in a separate vault. Always validate desired properties on the device side to avoid incorrect configurations.Push Notifications via Azure Notification Hubs
Push notifications for IoT events are organized through Event Grid + Azure Function + Azure Notification Hubs. Event Grid subscribes to IoT Hub events (e.g., Microsoft.Devices.DeviceTelemetry), triggers a Function, which sends push through Notification Hubs to FCM or APNs. On Flutter we integrate via firebase_messaging (for FCM) — Notification Hubs manages registrations and targeting, and delegates delivery to the platform. Tagging registrations by userId allows sending push to a specific user without storing tokens on the IoT backend.
What's Included in the Work
- Architectural documentation — data flow diagrams, protocol selection (MQTT/AMQP), security model.
- Deployment and configuration of Azure IoT Hub — tier selection, scaling, monitoring via Azure Monitor.
- Implementation of a backend proxy for SAS token generation.
- SDK integration into the mobile app (iOS/Android/Flutter/React Native).
- Configuration of Device Twin and Direct Methods.
- Push notification integration via Event Grid and Notification Hubs.
- Testing — load (up to 1000 concurrent devices), security, error scenarios.
- Team training — documentation, code review, 2 weeks of support.
For more on authentication, see Azure IoT Hub documentation.
Timeline
Basic integration (SAS tokens, MQTT/AMQP connection, Device Twin) — 2–3 weeks. Adding Direct Methods, Event Grid, push notifications — another 2 weeks. Final cost is calculated individually, depending on the number of devices, IoT Hub tier, and message frequency.
Get a consultation for your project — we'll assess the complexity and propose the optimal solution. Leave a request and we'll get back to you within a day.