How is device twin data telemetery data on built in endpoint secured in IoTHub

Question

How is device twin data telemetery data on built in endpoint secured in IoTHub

Mike Finch 40

We have a requirement to store data at rest encrypted.
I cannot find documentation of how the data in IoTHub is stored:
I found these questions:
https://stackoverflow.com/questions/65682085/store-secrets-in-devicetwin
https://learn.microsoft.com/en-us/answers/questions/332090/where-is-my-sensor-data-being-stored-in-the-iot-hu

But did not find a meaningful answer.

Thanks,

Mike

0 comments

Answer accepted by question author

AI answer

Device twin data and telemetry that IoT Hub handles on its built-in endpoints is protected both in transit and at rest by the platform.

For data in transit:

IoT Hub requires TLS for data-plane communications. Telemetry, twin updates, and other device-to-cloud or cloud-to-device operations are encrypted over the wire using TLS, as covered under IoT Hub’s data-in-transit encryption. This is enabled by default and managed by Microsoft; no extra configuration is required for standard IoT Hub usage.

For data at rest:

Customer content that IoT Hub stores (including device twin state and telemetry retained within the service) is encrypted at rest using Microsoft-managed keys by default, as part of Azure’s platform-level “encryption at rest” implementation.
Encryption at rest in Azure uses symmetric encryption keys stored in secure key stores with identity-based access control and auditing. Platform-managed keys are used automatically unless a given Azure service explicitly supports customer-managed keys. In the IoT Hub security baseline, data-at-rest encryption using platform keys is listed as supported and enabled by default.

If additional protection is required beyond platform encryption (for example, for highly sensitive fields in device twins or telemetry), data should be encrypted at the device or application level before being sent to IoT Hub, so that only downstream consumers with the appropriate keys can decrypt it.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

1 additional answer

Your answer

Answer 1

Hello @Mike Finch

Thank you for Reaching out to Microsoft Q&A.

Based on your requirement, you are looking to understand how Azure IoT Hub secures device twin data, telemetry data, and data retained on the built-in endpoint, particularly with respect to encryption at rest.

Here’s a summary of how Azure IoT Hub handles this today.

In-transit security: All communication between devices and IoT Hub is encrypted using TLS 1.2+. This applies to device-to-cloud telemetry, cloud-to-device messaging, twin updates, direct methods, and service-side operations.

At-rest security: IoT Hub internally stores: device identities, device twin JSON documents, routing metadata, retained telemetry for the built-in endpoint, and related service state within Azure-managed backend storage infrastructure.

This data is encrypted at rest by default using Azure Storage Service Encryption (AES-256 with Microsoft-managed keys).

No additional configuration is required for baseline encryption-at-rest protection.

Regarding the built-in endpoint specifically: The built-in endpoint (messages/events) is Event Hubs-compatible and is intended primarily for transient telemetry ingestion and streaming scenarios. Telemetry retained there is temporarily stored internally by the IoT Hub service according to the configured retention period. Microsoft manages the underlying storage layer and encryption implementation for this endpoint.

Few clarifications:

• Customers do not directly access or manage the physical storage backing the built-in endpoint.

• There is currently no separate/public encryption toggle specifically for the built-in endpoint.

• The service automatically encrypts retained data at rest using Microsoft-managed keys.

Regarding Customer-Managed Keys (CMK): If your requirement is specifically:

• customer-controlled encryption keys, independent key rotation, revocation control, or compliance-driven key ownership,

then the recommended approach is typically to route telemetry and events to downstream Azure services where CMK is supported.

For example: Azure Blob Storage, Azure Data Lake Storage, Azure Event Hubs, Azure Cosmos DB using IoT Hub message routing.

On those downstream services, you can enable: • Customer-Managed Keys (CMK), • Azure Key Vault integration, • and additional compliance/security controls.

Please refer this

Understand and use device twins in IoT Hub https://learn.microsoft.com/azure/iot-hub/iot-hub-devguide-device-twins

Secure your Azure IoT Hub deployment (Data protection section) https://learn.microsoft.com/azure/iot-hub/secure-azure-iot-hub#data-protection

Data protection at rest via standard encryption algorithms https://learn.microsoft.com/azure/iot-hub/iot-hub-tls-support

Thank you!

SRILAKSHMI C 19,725 Reputation points Microsoft External Staff Moderator

2026-05-21T11:57:17.34+00:00

Hi @Mike Finch,

Following up to see if the above answer was helpful. If this answers your query, please do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thank you!