🚀 1.0.0b2 Preview

The 1.0 preview brings device identity, provisioning, and fleet updates closer
together—all from your terminal.

• 🗂️ A home for every device. 112 preview commands under az iot adr cover
  namespaces, Registry Devices, identities, certificates, groups, jobs, and reports.
• 🔗 Connect the pieces. Link namespaces to IoT Hub, DPS, and Software Updates,
  with prerequisite checks and automatic role assignments when authorized.
• 🔐 Certificate-aware onboarding. Manage certificate authorities and policies,
  register devices through DPS with a CSR, and retrieve issued certificate chains.
• 📦 Manage fleet updates. Generate v5 manifests, stream artifacts to storage,
  organize device groups, and manage update jobs and compliance reports.

⚙️ Refreshed APIs

Updated SDKs power the new workflows and existing Hub/DPS commands:

📝 Before upgrading

Namespace linking now lives under az iot adr ns link; Hub/DPS and namespace
create/update commands no longer accept link inputs.

This is a preview, not a GA release. Preview APIs support Azure public cloud
only. Requires Azure CLI 2.73.0+ and Python 3.10+.

What's Changed

• feat: adr ns by Hangyi (@HangyiWang) in #840
• fix: run release integration tests in Australia East by Hangyi (@HangyiWang) in #903
• perf: parallel universe (4h → 1.5h) by Hangyi (@HangyiWang) in #904
• fix(adr): allow certificate policy validity from 1 to 90 days by Hangyi (@HangyiWang) in #910
• fix(adr): keep service failure as cause when link recovery stops by Hangyi (@HangyiWang) in #908
• chore: prepare 1.0.0b2 preview release by Hangyi (@HangyiWang) in #914

Full Changelog: v0.33.0b1...v1.0.0b2

What's Changed

• chore: add Azure IoT CLI maintainer agent and TypeSpec SDK skill by Yuelin Zhao (@cheatsheet1999) in #877
• fix: backfill hostName on dps linked hub update  by Yuelin Zhao (@cheatsheet1999) in #878
• chore: Generate SDK for IoT DPS 2026-08-31 API by Yuelin Zhao (@cheatsheet1999) in #879
• feat: add --disable-local-auth to az iot dps create/update by Yuelin Zhao (@cheatsheet1999) in #880
• chore: merge dev into preview by Yuelin Zhao (@cheatsheet1999) in #881
• feat: add --disable-local-auth to az iot dps create/update  by Yuelin Zhao (@cheatsheet1999) in #882
• chore(release): prepare v0.31.0 by Yuelin Zhao (@cheatsheet1999) in #887
• test(ADU): skip private endpoint connection test blocked by eastus2euap service regression by Yuelin Zhao (@cheatsheet1999) in #888
• feat: adr ns September release API alignment by Hangyi (@HangyiWang) in #892
• feat: merge dev into preview and add DPS RBAC by Yuelin Zhao (@cheatsheet1999) in #893
• fix: stabilize IoT Hub integration tests against query lag by Yuelin Zhao (@cheatsheet1999) in #894
• test: Stabilize ADR namespace integration tests by Yuelin Zhao (@cheatsheet1999) in #896

Full Changelog: v0.32.0b1...v0.33.0b1

What's Changed

• chore: add Azure IoT CLI maintainer agent and TypeSpec SDK skill by Yuelin Zhao (@cheatsheet1999) in #877
• chore: Generate SDK for IoT DPS 2026-08-31 API by Yuelin Zhao (@cheatsheet1999) in #879
• feat: add --disable-local-auth to az iot dps create/update by Yuelin Zhao (@cheatsheet1999) in #880
• feat: add --disable-local-auth to az iot dps create/update  by Yuelin Zhao (@cheatsheet1999) in #882
• chore(release): prepare v0.31.0 by Yuelin Zhao (@cheatsheet1999) in #887
• test(ADU): skip private endpoint connection test blocked by eastus2euap service regression by Yuelin Zhao (@cheatsheet1999) in #888

Full Changelog: v0.30.0...v0.31.0

What's Changed

• ci: update preview branch with integration test workflow and security fixes by Hangyi (@HangyiWang) in #817
• ci: fix Python 3.10 cryptography import error and split scheduler workflow by Hangyi (@HangyiWang) in #818
• fix: tweak ADR BYOR int tests by Hangyi (@HangyiWang) in #821
• chore: merge dev into preview by Yuelin Zhao (@cheatsheet1999) in #830
• chore: merge tls13 support into preview by Yuelin Zhao (@cheatsheet1999) in #831
• fix: hostname routing in module/device by Yuelin Zhao (@cheatsheet1999) in #833
• feat: support switching on dps linked-hub update by Yuelin Zhao (@cheatsheet1999) in #835
• fix: set hostName when creating KeyBased linked hub by Yuelin Zhao (@cheatsheet1999) in #841
• test: 99% unit test coverage by Hangyi (@HangyiWang) in #843
• test: Integration Test Fixes by Hangyi (@HangyiWang) in #844
• ci: upgrade NodeJS 24 for IoT CLI extension workflows by Hangyi (@HangyiWang) in #845
• fix: bump wheel version to fix CI linter by Hangyi (@HangyiWang) in #853
• ci: add read-after-create retries to iot hub integration test by Hangyi (@HangyiWang) in #855
• test: fix iothub identity fixtures reading principalId from empty hub create response by Hangyi (@HangyiWang) in #857
• feat: remove --hostname-type option from linked-hub update by Yuelin Zhao (@cheatsheet1999) in #856
• chore: Merge dev into preview by Yuelin Zhao (@cheatsheet1999) in #859
• chore: merge fabric eventstream feature branch into preview by Yuelin Zhao (@cheatsheet1999) in #867
• chore: merge dev into preview for 0.32.0b1 release prep by Yuelin Zhao (@cheatsheet1999) in #869
• fix: route data-plane operations to the correct GWv2 endpoint by Yuelin Zhao (@cheatsheet1999) in #873
• fix: add preview flag to az iot adr ns commands by Hangyi (@HangyiWang) in #870
• chore: add preview label for TLS1.3+MI feature by Yuelin Zhao (@cheatsheet1999) in #874

Full Changelog: v0.30.0...v0.32.0b1

Device Update (ADU) updates

• Added --download-security parameter to az iot du device deployment create to select the protocol used for update payload downloads. Defaults to https (TLS); use http only when the target environment does not support TLS.

• Updated the Device Update data plane SDK to API version 2026-06-01.

• Fixed az iot du device import where the import_type payload did not match the service expectation.

• Fixed az iot du storage access to support newer azure-mgmt-storage releases (v25+) when retrieving storage account keys.

IoT Hub updates

• Fixed az iot hub state export to preserve routing endpoint resource names (Event Hub / Service Bus namespaces, Cosmos DB / Storage accounts) whose names begin with characters found in the URI scheme. Endpoints are no longer dropped or corrupted during export.

General updates

• [Breaking Change] Minimum supported Python version bumped from 3.9 to 3.10.

• Updated jsonschema dependency to >=4.25,<5.

• Added aiohttp>=3.9,<4.0 as a required dependency to support AMQP over WebSocket transport for event monitoring.

• Removed remaining uamqp references from help text and documentation.

• Replaced deprecated datetime.utcnow() and codecs.open calls with timezone-aware equivalents.

IoT Hub / IoT Central monitoring updates

• az iot hub monitor-events and az iot central diagnostics monitor-events / validate-messages now automatically route traffic through an HTTP proxy when the HTTPS_PROXY or HTTP_PROXY environment variable is set, using AMQP over WebSocket transport.

• Added --transport (--tr) parameter to az iot hub monitor-events, az iot central diagnostics monitor-events, and az iot central diagnostics validate-messages to explicitly select the underlying transport protocol (amqp or amqp_ws). Defaults to amqp; amqp_ws (AMQP over WebSocket) is required when routing through an HTTP proxy or when port 5671 is blocked.

• az iot hub monitor-events --login now accepts an Event Hub connection string (e.g. the built-in endpoint connection string from the Azure portal) in addition to an IoT Hub connection string.

What's Changed

• chore: sync dev branch with release/cms_public_preview by Ketki Naik (@ketkimnaik) in #785

• fix: pass cloud-specific credential_scopes by Yuelin Zhao (@cheatsheet1999) in #786

• feat(adr): add policy revoke-issuer & device CRUD/revoke by Hangyi (@HangyiWang) in #788

• chore: merge dev into cms_public_preview_refresh by Yuelin Zhao (@cheatsheet1999) in #794

• chore: replace hardcoded canary ARM endpoint with dynamic cloud endpoint by Hangyi (@HangyiWang) in #796

• chore: remove LRO workarounds for policy revokeIssuer and activateBYOR by Hangyi (@HangyiWang) in #797

• chore: rename --enable-certificate-management parameter by Hangyi (@HangyiWang) in #798

• fix: send non-nullable disable property in device revoke request by Hangyi (@HangyiWang) in #799

• chore: increase cms dev version number for internal testing by Hangyi (@HangyiWang) in #801

• chore: adjust CMS device integration test by Hangyi (@HangyiWang) in #802

• chore: CMS preview refresh version update by Hangyi (@HangyiWang) in #804

• fix: cleanup helper message format by Hangyi (@HangyiWang) in #807

• policy revoke-issuer (az iot adr ns policy revoke-issuer): revokes the current CA (issuer) certificate for a namespace policy and triggers the service to generate a new one. Use this when the CA certificate is compromised or needs rotation.

• bring your own root / BYOR (--enable-byor / az iot adr ns policy activate-byor): enables customers to use their own root CA instead of a service-managed one.

• device revoke (az iot adr ns device revoke): revokes all active credentials for a specified device in a namespace. The device must re-authenticate and obtain new credentials. Use --disable to also prevent the device from obtaining new credentials (sets device enabled state to false).

Full Changelog: v0.30.0b1...v0.30.0b2

General updates

• Updated azure-iot-device dependency to >=2.15.0rc1,<3.0.0dev0 for Windows platform compatibility.

What's Changed

• fix: draft github release from non-default branches by Ryan K (@c-ryan-k) in #758
• fix: solve SDL task warnings by Ryan K (@c-ryan-k) in #759
• chore(ci): update runner images by Ryan K (@c-ryan-k) in #764
• feat: replace uamqp with PyAMQP by Ketki Naik (@ketkimnaik) in #767
• fix: handle redacted SharedAccessKey in connection string parsing by Ketki Naik (@ketkimnaik) in #769
• chore(release): prepare v0.28.0 by Ketki Naik (@ketkimnaik) in #770

New Contributors

• Ketki Naik (@ketkimnaik) made their first contribution in #767

Full Changelog: v0.27.0...v0.28.0

General updates

• This is a public preview release for IoT Hub Gen2 and Certificate Management using Azure Device Registry.

• This release requires Azure CLI core version 2.67.0 or later.

• To install preview extensions, you will need to add the --allow-preview argument to az extension add/update commands.

• This release alters and overrides several existing IoT Hub and DPS commands from CLI core modules, namely control-plane management commands for IoT Hub and DPS.

• These commands will display the following expected warning when using this extension:

  • The behavior of this command has been altered by the following extension: azure-iot

Azure Device Registry updates

• New command group az iot adr ns to manage Azure Device Registry namespaces, policies and credentials

  • az iot adr ns to manage Device Registry namespaces.
  • az iot adr ns credential to manage namespace credentials.
  • az iot adr ns policy to manage namespace policies.

• New management SDK using 2025-11-01-preview API version.

IoT Hub updates

• New management SDK using 2025-08-01-preview API version.

• New Hub Gen2 SKU to support ADR integration.

• Gen2 hub creation now supports linking an ADR namespace using --ns-resource-id and --ns-identity-id arguments.

  • When linking an ADR namespace, our CLI will attempt to create role assignments for the ADR namespace to manage the Hub.
  • --skip-ns-ra can be used to skip role assignment creation, or --custom-ns-role-id can be used to specify a custom role assignment.

DPS updates

• New management SDK using 2025-02-01-preview and service SDK using 2025-07-01-preview API versions.
• DPS creation now supports linking an ADR namespace with --ns-resource-id and --ns-identity-id arguments.
• Enrollment and enrollment-group commands now support configuring an ADR credential policy with the --credential-policy-name argument.
• DPS now support both system and user assigned managed identities.