Revoke certificates and delete policies (preview)

Revoke certificates for a device

Use these steps to rotate one device certificate when you need to isolate risk to a single device.

1. Sign in to the Azure portal.
2. Open your Azure Device Registry namespace.
3. Under Namespace resources on the sidebar menu, select Devices.
4. Select the target device.
5. Select Revoke device certificates.
6. (Optional) Select Also disable device after revoking if you need to block device authentication.
7. Confirm the operation.

Revoke certificates for a policy

Use these steps to rotate a policy issuer when you need to invalidate certificates issued by that policy.

1. Open your Azure Device Registry namespace.
2. Under Namespace resources on the sidebar menu, select Credential Policies.
3. Select the target policy.
4. Select Revoke certificates, and confirm the operation.

For a standard policy that uses your namespace's root CA, Azure Device Registry rotates the issuing CA and syncs the replacement CA to linked hubs.

For a policy that uses an external root, you cannot revoke the policy on Azure Device Registry as the CRL is also external. You must ensure that the revocation also propagates to that external CA's certificate revocation list (CRL) or OCSP responder. We require that you revoke all of your leaf certificates and then delete your policy.

Delete a policy

Use these steps to remove a policy when you no longer need it for certificate issuance.

1. Open your Azure Device Registry namespace.
2. Under Namespace resources on the sidebar menu, select Credential policies.
3. Select the target policy.
4. Select Delete policy, and confirm the operation.

Delete a credential resource

Use these steps to remove a credential resource when you need to retire that certificate path.

1. Open Credential policies in your Device Registry namespace.
2. Select the credential resource.
3. Select Delete, and confirm the delete operation.

Set variables

Define shared variables first so you can reuse the same values across all commands and reduce input errors.

RG_NAME="<resource-group>"
NS_NAME="<adr-namespace>"
HUB_NAME="<iot-hub-name>"
POLICY_NAME="<policy-name>"
DEVICE_ID="<device-id>"

Revoke a device

Run this command to revoke a device from Device Registry.

az iot adr ns device revoke \
  -n <device-id> \
  --ns "$NS_NAME" \
  -g "$RG_NAME" \
  -y

To revoke a device and also disable it, run the following command.

az iot adr ns device revoke \
  -n <device-id> \
  --ns "$NS_NAME" \
  -g "$RG_NAME" \
  -disable
  -y

Revoke certificates for a policy that uses the namespace-level root CA

Run this command to rotate a standard policy issuer and trigger the service-managed revoke flow.

az iot adr ns policy revoke-issuer \
  --ns "$NS_NAME" \
  -g "$RG_NAME" \
  --policy-name "$POLICY_NAME" \
  -y

Delete a policy

Run this command to remove a policy that you no longer need in the namespace.

az iot adr ns policy delete \
  --ns "$NS_NAME" \
  -g "$RG_NAME" \
  --policy-name "$POLICY_NAME" \
  -y

Run this command to confirm the deleted policy no longer appears.

az iot adr ns policy list --ns "$NS_NAME" -g "$RG_NAME"

Verify that the deleted policy no longer appears.

Delete a credential resource

Run this command to remove the credential resource when you retire that trust anchor path.

az iot adr ns credential delete \
  --ns "$NS_NAME" \
  -g "$RG_NAME" \
  --credential-name default \
  -y

Run this command to confirm the credential resource is no longer available.

az iot adr ns credential show \
  --ns "$NS_NAME" \
  -g "$RG_NAME" \
  --credential-name default

Verify that the credential resource is no longer available.