Why does disable on a device not disable the device

Question

Why does disable on a device not disable the device

Oetze van den Broek 131

I am using Azure IoT Hub and DPS.

We have implemented reprovisioning once a device is blocked in Azure IoT Hub.

When i disable the device in Azure IoT Hub by setting "Enable connection to IoT Hub" to false, clicking save and then rebooting the device. I would assume that no new connection would be allowed. But the device connects without problems and i can still interact with it (send commands).

How do i properly block the device (and force reprovisioning as a result)

I believe the steps i'm taking are correct. Could this be a bug?

Manas Mohanty 3,125 Reputation points Microsoft External Staff

2025-03-27T10:43:25.4533333+00:00

Hi Oetze van den Broek

Hope the pointers shared from Sander van de Velde | MVP have been useful to you. Please let us know if you still have any questions on same context.

Thank you

Oetze van den Broek 131

I did some digging to find what is happening.

I've used mosquitto_sub to test this so my device firmware can't be the problem.

I can see that there is a difference in a device using a SAS token and a device using a certificate.

I've added the commands i used below.

With SAS token and device in IoT Hub enabled

PS C:\mypath> mosquitto_sub -h my-iot-hub.azure-devices.net -p 8883 `
>> -u "my-iot-hub.azure-devices.net/my-sas-device/?api-version=2021-04-12" `
>> -i "my-sas-device" -t "$iothub/methods/POST/#" `
>> --cafile ".\certs\DigiCertGlobalRootG2.crt.pem" `
>> -P "SharedAccessSignature sr=my-iot-hub.azure-devices.net%2Fdevices%2Fmy-sas-device&sig=my-signature&se=1743091608" -d
Client my-sas-device sending CONNECT
Client my-sas-device received CONNACK (0)
Client my-sas-device sending SUBSCRIBE (Mid: 1, Topic: /methods/POST/#, QoS: 0, Options: 0x00)
Client my-sas-device received SUBACK
Subscribed (mid: 1): 0

With SAS token and device in IoT Hub disabled

PS C:\mypath> mosquitto_sub -h my-iot-hub.azure-devices.net -p 8883 `
>> -u "my-iot-hub.azure-devices.net/my-sas-device/?api-version=2021-04-12" `
>> -i "my-sas-device" -t "$iothub/methods/POST/#" `
>> --cafile ".\certs\DigiCertGlobalRootG2.crt.pem" `
>> -P "SharedAccessSignature sr=my-iot-hub.azure-devices.net%2Fdevices%2Fmy-sas-device&sig=my-signature&se=1743091608" -d
Client my-sas-device sending CONNECT
Client my-sas-device received CONNACK (5)
Connection error: Connection Refused: not authorised.
Client my-sas-device sending DISCONNECT
PS C:\mypath>

With Certificate and device in IoT Hub enabled

PS C:\mypath> mosquitto_sub -h my-iot-hub.azure-devices.net -p 8883 `
>>  -u "my-iot-hub.azure-devices.net/my-cert-device/?api-version=2021-04-12" `
>>  -i "my-cert-device" `
>>  --cert ".\certs\my-cert-device\my-cert-device-primary.cert.pem" `
>>  --key ".\certs\my-cert-device\my-cert-device-primary.key.pem" `
>>  -t "$iothub/methods/POST/#" `
>>  --tls-use-os-certs `
>>  --cafile ".\certs\DigiCertGlobalRootG2.crt.pem" -d
Client my-cert-device sending CONNECT
Client my-cert-device received CONNACK (0)
Client my-cert-device sending SUBSCRIBE (Mid: 1, Topic: /methods/POST/#, QoS: 0, Options: 0x00)
Client my-cert-device received SUBACK
Subscribed (mid: 1): 0

With Certificate and device in IoT Hub disabled

PS C:\mypath> mosquitto_sub -h my-iot-hub.azure-devices.net -p 8883 `
>>  -u "my-iot-hub.azure-devices.net/my-cert-device/?api-version=2021-04-12" `
>>  -i "my-cert-device" `
>>  --cert ".\certs\my-cert-device\my-cert-device-primary.cert.pem" `
>>  --key ".\certs\my-cert-device\my-cert-device-primary.key.pem" `
>>  -t "$iothub/methods/POST/#" `
>>  --tls-use-os-certs `
>>  --cafile ".\certs\DigiCertGlobalRootG2.crt.pem" -d
Client my-cert-device sending CONNECT
Client my-cert-device received CONNACK (0)
Client my-cert-device sending SUBSCRIBE (Mid: 1, Topic: /methods/POST/#, QoS: 0, Options: 0x00)
Client my-cert-device received SUBACK
Subscribed (mid: 1): 0

As you can see, the device that is using the certificate has accepted connection, even though it's disabled

Oetze van den Broek 131 Reputation points

2025-03-27T16:53:29.2866667+00:00

This is some context i added . The problem only occurs when using certificate based authentication. I hope someone can clear up why this is.

2 answers

Your answer

Manas Mohanty 3,125 Reputation points Microsoft External Staff

2025-03-27T10:43:25.4533333+00:00

Hi Oetze van den Broek

Hope the pointers shared from Sander van de Velde | MVP have been useful to you. Please let us know if you still have any questions on same context.

Thank you
Oetze van den Broek 131 Reputation points

2025-03-27T16:53:29.2866667+00:00

This is some context i added . The problem only occurs when using certificate based authentication. I hope someone can clear up why this is.

Answer 1

Sander van de Velde | MVP 36,131 MVP

Hello @Oetze van den Broek ,

welcome to this moderated Azure community forum.

This is not a bug but part of a larger workflow so this is a known flow and there is a simple solution.

If a device is disabled in the IoT Hub, the device will try to reprovision via the Device Provisioning Service.

Just disable the device registration in the Device Provisioning Service too.

Then reprovisioning to the same or another IoT Hub is disabled at the (DPS) source.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Oetze van den Broek 131 Reputation points

2025-03-27T14:24:49.29+00:00

This is not the problem i'm facing.

The problem is that i disabled the device in IoT Hub. But the device can still connect to that IoT Hub. It's connection is never refused.

I've currently waited more than 12 hours. So i don't think it's a timing issue.

For context. The device is on my desk, i can see the logs
Oetze van den Broek 131 Reputation points

2025-03-27T14:25:51.4833333+00:00

The connection to the IoT Hub is never refused, so the device will never start reprovisioning, because it doesn't have to.
Manas Mohanty 3,125 Reputation points Microsoft External Staff

2025-03-27T15:30:39.97+00:00
Hi Oetze van den Broek

Could you run below CLI command to force update device connection false through digital twins and let us know.

az login --identity az iot hub device-twin update --device-id [Device ID] --hub-name [IoT Hub Name] --set properties.desired.status=disabled #please replace with actual device id and iot hub name.

Then we can run SDK code to connect through device connection string, if it fails then it can run DPS provisioning python script for DPS provisioning.

I would suggest you connect a separate IOT hub for DPS provisioning than used previously connecting the device.

Thank you.
Manas Mohanty 3,125 Reputation points Microsoft External Staff

2025-03-27T15:53:18.9033333+00:00

Hi Oetze van den Broek

Sorry I could not see your update posted at 0857 pm, as I was in middle of suggesting from my notion of investigation in previous post.

It seems you have found the root cause on your side.

with "Certificate and device in IoT Hub disabled" mode, it is taking certificates as backup authentication and connecting to IOT hub.

Then I think we should revoke the certificates too to completely disconnect the device from IOT hub.

Thank you.
Oetze van den Broek 131 Reputation points

2025-03-27T17:43:11.2633333+00:00

The command you suggested is not working, it's adding a desired property called "status" to my device twin with the value "disabled".

The acutual status property on the device in the root twin is already set to disabled

I don't see how revoking the certificates can help in this case. Can you even revoke the certificates on a thumbprint device?

The problem is that the setting "Enable connection to IoT Hub" to "Disable" does not seem to do anything to disable the device. It still allows new connections for that device.
Manas Mohanty 3,125 Reputation points Microsoft External Staff

2025-03-28T08:07:28.24+00:00

Hi Oetze van den Broe

Here is my hypothesis. "Setting Device connection False" is disabling Primary and secondary connection string here

As the DPS is linked to IOT hub, it will be using thumbprint certificate to connect to linked IOT hub as a backup authentication now. So, it seems to work as expected for me (Connect through DPS while Device connection is false)

We can disallow a Device from DPS either from Individual or Group enrollment by Selecting Manage enrollment and unticking "Enable this enrollment option" and save.

Once enrollment is stopped, you can set "Enable connection to IoT Hub" to True to connect through primary and second string again.

Please let me know if it clarifies the situation.

Thank you
Oetze van den Broek 131 Reputation points

2025-03-28T10:30:49.0533333+00:00

I don't think DPS has anything to do with the problem.

To test it, i've also created a device on the IoT Hub directly with thumbprint authentication (individual enrollement, X509 Self-Signed)

The problem still persists.

I strongly believe that blocking a device that is using indiviual enrollment with thumbprint authentication can currently not be blocked in the IoT Hub due to a bug of some sort.

Answer 2

Manas Mohanty 3,125 Microsoft External Staff

Hi Oetze van den Broek

We have noticed that you rated an answer as not helpful. We appreciate your feedback and are committed to improving your experience with the Q&A.

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Ask: Setting Device connection false from IOT hub is not stopping Devices to connect.

Solution: From the investigation on Customer side, it was found out that customer had primary certificates aside device connection strings to connect through MQTT broker. It was suggested to revoke the underlying primary certificates along setting device connection false to completely stop the device connecting back.

If I missed anything please let me know and I'd be happy to add it to this answer, or feel free to comment below with any additional information.

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.

Thank You.

Oetze van den Broek 131 Reputation points

2025-03-27T16:52:04.3933333+00:00

No, the question hasn't been answered, clicking on no for accepted answer was a mistake which i corrected.

The problem is still ongoing. I added some information that might be usefull for answering this question.
Manas Mohanty 3,125 Reputation points Microsoft External Staff

2025-03-27T16:57:50.1066667+00:00

Hi Oetze van den Broek

Have you revoked the certificates too to completely disconnect the device from IOT hub.

It is working as back up authentication here.

Thank you.
Oetze van den Broek 131 Reputation points

2025-03-27T17:01:44.97+00:00

No i haven't. The device is using "thumprint" authentication actually. It was provisioned by DPS using a intermediate certificate for multiple devices.

I can't update the thumbprints

Share via

Why does disable on a device not disable the device

2 answers

Your answer