IoT Hub should disable local authentication

High Azure General iothub-no-local-auth

Applies to

Microsoft.Devices/IotHubs

What CGPulse checks

A resource passes this rule when disableLocalAuth must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable local authentication and require Azure AD for scoped, auditable access. In Azure Portal: IoT Hub > Settings > disable local authentication. See: https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-disable-local-auth

Careful: Disabling local auth breaks all devices using SAS tokens or connection strings. Ensure all devices use Azure AD or X.509 certificates

CLI

az iot hub update --ids "{id}" --set properties.disableLocalAuth=true

Terraform

resource "azurerm_iothub" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  local_authentication_enabled = false
  sku {
    name     = "S1"
    capacity = 1
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan