Configure the connector for OPC UA

1. Select devices and then Create device:

   

   Tip

   Use the filter box to search for devices.

2. On the Basics page, enter a device name and select New on the Microsoft.OpcUa tile to add an endpoint for the device:

   

3. Enter your endpoint information. For example, to use the OPC PLC simulator, enter the following values:

   Field	Value
   Name	opc-ua-connector-0
   Connector for OPC UA URL	opc.tcp://opcplc-000000:50000
   User authentication	Anonymous

4. Select Next. On the Additional Info page enter any custom properties for the device.

5. Select Next to review your device details. Then select Create.

Run the following commands:

az iot ops ns device create \
  -n opc-ua-connector-cli \
  -g {your resource group name} \
  --instance {your instance name}

az iot ops ns device endpoint inbound add opcua \
  --device opc-ua-connector-cli \
  -g {your resource group name} \
  -i {your instance name} \
  --name opc-ua-connector-0 \
  --endpoint-address "opc.tcp://opcplc-000000:50000"

To learn more, see az iot ops ns device.

Deploy the following Bicep template to create a device with an inbound endpoint for the OPC UA connector. Replace the placeholders <AIO_NAMESPACE_NAME> and <CUSTOM_LOCATION_NAME> with your Azure IoT Operations namespace name and custom location name respectively:

param deviceRegistryNamespaceName string = '<AIO_NAMESPACE_NAME>'
param customLocationName string = '<CUSTOM_LOCATION_NAME>'

resource deviceRegistryNamespace 'Microsoft.DeviceRegistry/namespaces@2026-04-01' existing = {
  name: deviceRegistryNamespaceName
}

resource customLocation 'Microsoft.ExtendedLocation/customLocations@2021-08-31-preview' existing = {
  name: customLocationName
}

resource device 'Microsoft.DeviceRegistry/namespaces/devices@2026-04-01' = {
  name: 'opc-ua-connector-bicep'
  parent: deviceRegistryNamespace
  location: resourceGroup().location
  extendedLocation: {
    type: 'CustomLocation'
    name: customLocation.id
  }
  properties: {
    endpoints: {
      outbound: {
        assigned: {}
      }
      inbound: {
        'opc-ua-connector-0': {
          endpointType: 'Microsoft.OpcUa'
          address: 'opc.tcp://opcplc-000000:50000'
          authentication: {
            method: 'Anonymous'
          }
        }
      }
    }
  }
}

In the operations experience, when you add the inbound endpoint and choose the Username password authentication mode, select Add reference to add the secret references for the username and password. The operations experience offers two options:

• Create a new secret: uploads the value to Azure Key Vault and synchronizes it to the cluster as a synced secret.
• Add from Azure Key Vault: synchronizes an existing Key Vault secret to the cluster.

The operations experience saves both the username and password references in a single synced secret resource on the cluster, and you give that synced secret a name.

To learn more, see Add and use secrets.

1. Make sure the username and password are stored as secrets in Azure Key Vault. To learn more, see Add secrets to Azure Key Vault.

2. Create a single synced secret on the cluster that references both Key Vault secrets. The following example creates a synced secret named my-endpoint-creds that maps the Key Vault secrets my-kv-username and my-kv-password to the keys username and password:

   az iot ops secretsync secret set \
     --instance <your-instance-name> \
     --resource-group <your-resource-group> \
     --name my-endpoint-creds \
     --secret target=username source=my-kv-username \
     --secret target=password source=my-kv-password
   

   For more information, see az iot ops secretsync secret set.

3. Use the az iot ops ns device endpoint inbound add command with the --user-ref and --pass-ref parameters to reference the synced secret name and key for the username and password (for example, my-endpoint-creds/username and my-endpoint-creds/password).

1. Make sure the username and password are stored as secrets in Azure Key Vault, and that a synced secret on the cluster references both Key Vault secrets. You can create the synced secret either through the operations experience or by using the Azure CLI. To learn more, see Manage secrets for your Azure IoT Operations deployment.

2. Modify the authentication block of your Bicep configuration for the connector to reference the synced secret on the cluster. The usernameSecretName and passwordSecretName values use the form <synced-secret-name>/<key>:

   authentication: {
       method: 'UsernamePassword'
           usernamePasswordCredentials: {
               usernameSecretName: 'my-endpoint-creds/username'
               passwordSecretName: 'my-endpoint-creds/password'
           }
   }
   

In the operations experience, when you add the inbound endpoint and choose the X509 certificate authentication mode, select Add reference to add the secret reference for the client certificate and private key. The operations experience offers two options:

• Create a new secret: uploads the certificate and private key files to Azure Key Vault and synchronizes them to the cluster as a synced secret.
• Add from Azure Key Vault: synchronizes existing Key Vault secrets to the cluster.

The operations experience saves the certificate and key references in a single synced secret resource on the cluster, and you give that synced secret a name.

To learn more, see Sync a client certificate and private key for mutual TLS.

1. Make sure the client certificate and private key are stored as secrets in Azure Key Vault. To learn more, see Sync a client certificate and private key for mutual TLS.

2. Create a single synced secret on the cluster that references both Key Vault secrets. The following example creates a synced secret named my-endpoint-cert that maps the Key Vault secrets my-kv-client-cert and my-kv-client-key to the keys certificate and privateKey:

   az iot ops secretsync secret set \
     --instance <your-instance-name> \
     --resource-group <your-resource-group> \
     --name my-endpoint-cert \
     --secret target=certificate source=my-kv-client-cert \
     --secret target=privateKey source=my-kv-client-key
   

   For more information, see az iot ops secretsync secret set.

3. Use the az iot ops ns device endpoint inbound add command with the --cert-ref and --key-ref parameters to reference the synced secret name and key for the certificate and private key (for example, my-endpoint-cert/certificate and my-endpoint-cert/privateKey). To include intermediate certificates, add --icr my-endpoint-cert/intermediateCerts.

1. Make sure the client certificate and private key are stored as secrets in Azure Key Vault, and that a synced secret on the cluster references both Key Vault secrets. You can create the synced secret either through the operations experience or by using the Azure CLI. To learn more, see Sync a client certificate and private key for mutual TLS.

2. Modify the authentication block of your Bicep configuration for the device inbound endpoint to reference the synced secret on the cluster. The certificateSecretName and keySecretName values use the form <synced-secret-name>/<key>:

   authentication: {
       method: 'Certificate'
           x509Credentials: {
               certificateSecretName: 'my-endpoint-cert/certificate'
               keySecretName: 'my-endpoint-cert/privateKey'
           }
   }
   

To add an asset in the operations experience, follow these steps:

1. Select the Assets tab. Before you create any assets, you see the following screen:

   

   Tip

   Use the filter box to search for assets.

2. Select Create asset.

3. On the asset details screen, enter the following asset information:

   • Inbound endpoint. Select your device inbound endpoint from the list.
   • Asset name
   • Description

4. Configure the set of custom properties that you want to associate with the asset. You can accept the default list of properties or add your own. The following properties are available by default:

   • Manufacturer
   • Manufacturer URI
   • Model
   • Product code
   • Hardware version
   • Software version
   • Serial number
   • Documentation URI

   

5. Select Next to go to the Datasets page.

Add a dataset to an asset

A dataset defines where the connector sends the data it collects from a collection of data points. An OPC UA asset can have multiple datasets. To create a dataset:

1. Select Create dataset.

2. Enter the details for the dataset such as its name and destination. For OPC UA assets, the destination is an MQTT topic. For example:

   

   Use the Start instance field to specify the starting node for resolving relative browse paths for data points in the dataset. For more information, see Resolve dynamic nodes by using browse paths.

3. Select Create and next to create the dataset.

Add individual data points to a dataset

Now you can define the data points associated with the dataset. To add OPC UA data points:

1. Select Add data point.

2. Enter your data point details:

   • Data source. This value is the node ID from the OPC UA server.
   • Data point name (Optional). This value is the friendly name that you want to use for the data point. If you don't specify a data point name, the node ID is used as the data point name.
   • Sampling interval (milliseconds). You can override the default value for this data point.
   • Queue size. You can override the default value for this data point.
   • Key frame count. By default, key frames are disabled. Use this setting to enable key frames and specify how frequently the connector generates key frames. For more information, see Configure key frames for state recovery.

   

   The following table shows some example data point values that you can use with the built-in OPC PLC simulator:

   Data source	Data point name
   ns=3;s=FastUInt10	Temperature
   ns=3;s=FastUInt100	Humidity

   Note

   If you're using relative browse paths to resolve dynamic nodes, the Data source field contains a relative browse path. For more information, see Resolve dynamic nodes by using browse paths.

3. On the data points page, select Next to go to the Add events page.

Use the following commands to add a thermostat asset to your device by using the Azure CLI. The commands add a dataset and two data points to the asset by using the datapoint add command:

# Create the asset
az iot ops ns asset opcua create \
  --name thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --device opc-ua-connector-cli \
  --endpoint opc-ua-connector-0 \
  --description 'A simulated thermostat asset'

# Add the dataset
az iot ops ns asset opcua dataset add \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --name oven \
  --data-source "" \
  --dest topic="azure-iot-operations/data/thermostat" retain=Never qos=Qos1 ttl=3600

# Add the data points
az iot ops ns asset opcua datapoint add \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --dataset oven \
  --name temperature \
  --data-source "ns=3;s=FastUInt10"

az iot ops ns asset opcua datapoint add \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --dataset oven \
  --name humidity \
  --data-source "ns=3;s=FastUInt100"

# Show the dataset and datapoints
az iot ops ns asset opcua dataset show \
  --asset thermostat \
  -n oven \
  -g {your resource group name} \
  --instance {your instance name}

When you create an asset by using the Azure CLI, you can define:

• Multiple data points by using the datapoint add command multiple times.
• Multiple event groups and events by using the event-group add and event add commands.
• Optional information for the asset such as:
  • Manufacturer
  • Manufacturer URI
  • Model
  • Product code
  • Hardware version
  • Software version
  • Serial number
  • Documentation URI
• Dataset values for sampling interval, publishing interval, key frame count, and queue size.
• Data point specific values for sampling interval, publishing interval, and queue size.
• Event-specific values for sampling interval and queue size.
• The observability mode for each data point and event

Deploy the following Bicep template to create an asset that publishes messages from the device shown previously to an MQTT topic. Replace the placeholders <AIO_NAMESPACE_NAME> and <CUSTOM_LOCATION_NAME> with your Azure IoT Operations namespace name and custom location name respectively:

param deviceRegistryNamespaceName string = '<AIO_NAMESPACE_NAME>'
param customLocationName string = '<CUSTOM_LOCATION_NAME>'

resource deviceRegistryNamespace 'Microsoft.DeviceRegistry/namespaces@2026-04-01' existing = {
  name: deviceRegistryNamespaceName
}

resource customLocation 'Microsoft.ExtendedLocation/customLocations@2021-08-31-preview' existing = {
  name: customLocationName
}

resource asset 'Microsoft.DeviceRegistry/namespaces/assets@2026-04-01' = {
  name: 'thermostat'
  parent: deviceRegistryNamespace
  location: resourceGroup().location
  extendedLocation: {
    type: 'CustomLocation'
    name: customLocation.id
  }
  properties: {
    displayName: 'thermostat'
    description: 'A simulated thermostat asset'
    enabled: true

    deviceRef: {
      deviceName: 'opc-ua-connector-bicep'
      endpointName: 'opc-ua-connector-0'
    }

    defaultDatasetsConfiguration: '{}'
    defaultEventsConfiguration: '{}'

    datasets: [
      {
        name: 'oven'
        datasetConfiguration: '{}'
        dataPoints: [
          {
            name: 'temperature'
            dataSource: 'ns=3;s=FastUInt10'
            dataPointConfiguration: '{}'
          }
          {
            name: 'humidity'
            dataSource: 'ns=3;s=FastUInt100'
            dataPointConfiguration: '{}'
          }
        ]
        destinations: [
          {
            target: 'Mqtt'
            configuration: {
              topic: 'azure-iot-operations/data/thermostat'
              qos: 'Qos1'
              retain: 'Never'
              ttl: 3600
            }
          }
        ]
      }
    ]
  }
}

1. In the operations experience, select Assets, and then open or create the my-triggered-asset asset. Select the opc-ua-connector-0 inbound endpoint on the namespaced device that you created previously.

2. On the Datasets page, select or create the telemetry dataset. Set the destination topic to azure-iot-operations/data/my-triggered-asset, the publishing interval to 1000 milliseconds, and the sampling interval to 500 milliseconds.

3. Add the following data points to the dataset. Data point names are case-sensitive.

   Data point name	Data source
   dataPoint-SlowUInt1	nsu=http://microsoft.com/Opc/OpcPlc/;s=SlowUInt1
   dataPoint-FastUInt1	nsu=http://microsoft.com/Opc/OpcPlc/;s=FastUInt1
   dataPoint-FastUInt2	nsu=http://microsoft.com/Opc/OpcPlc/;s=FastUInt2

4. In the dataset settings, set Triggering item to dataPoint-SlowUInt1 and Triggering item reporting mode to Sampling.

   

5. Save the asset configuration.

Azure CLI doesn't currently support setting triggeringItem or triggeringItemReportingMode. Use the operations experience or Bicep to configure dataset triggering. Don't use a generic asset update command to modify these connector-specific dataset properties.

Deploy the following Bicep template to create a namespaced asset with dataset triggering. Replace <IOT_OPERATIONS_NAMESPACE_NAME> and <CUSTOM_LOCATION_NAME> with your Azure IoT Operations namespace and custom location names:

param iotOperationsNamespaceName string = '<IOT_OPERATIONS_NAMESPACE_NAME>'
param customLocationName string = '<CUSTOM_LOCATION_NAME>'

resource iotOperationsNamespace 'Microsoft.DeviceRegistry/namespaces@2026-04-01' existing = {
  name: iotOperationsNamespaceName
}

resource customLocation 'Microsoft.ExtendedLocation/customLocations@2021-08-31-preview' existing = {
  name: customLocationName
}

resource asset 'Microsoft.DeviceRegistry/namespaces/assets@2026-04-01' = {
  name: 'my-triggered-asset'
  parent: iotOperationsNamespace
  location: resourceGroup().location
  extendedLocation: {
    type: 'CustomLocation'
    name: customLocation.id
  }
  properties: {
    displayName: 'my-triggered-asset'
    enabled: true
    deviceRef: {
      deviceName: 'opc-ua-connector-bicep'
      endpointName: 'opc-ua-connector-0'
    }
    defaultDatasetsConfiguration: '{}'
    defaultEventsConfiguration: '{}'
    datasets: [
      {
        name: 'telemetry'
        datasetConfiguration: '{"publishingInterval":1000,"samplingInterval":500,"triggeringItem":"dataPoint-SlowUInt1","triggeringItemReportingMode":"Sampling"}'
        dataPoints: [
          {
            name: 'dataPoint-SlowUInt1'
            dataSource: 'nsu=http://microsoft.com/Opc/OpcPlc/;s=SlowUInt1'
            dataPointConfiguration: '{}'
          }
          {
            name: 'dataPoint-FastUInt1'
            dataSource: 'nsu=http://microsoft.com/Opc/OpcPlc/;s=FastUInt1'
            dataPointConfiguration: '{}'
          }
          {
            name: 'dataPoint-FastUInt2'
            dataSource: 'nsu=http://microsoft.com/Opc/OpcPlc/;s=FastUInt2'
            dataPointConfiguration: '{}'
          }
        ]
        destinations: [
          {
            target: 'Mqtt'
            configuration: {
              topic: 'azure-iot-operations/data/my-triggered-asset'
              qos: 'Qos1'
              retain: 'Never'
              ttl: 3600
            }
          }
        ]
      }
    ]
  }
}

Add an event group to an asset

An event group defines where the connector sends the data it receives from a collection of events. An OPC UA asset can have multiple event groups. To create an event group:

1. Select Create event group.

2. Enter a name for the event group and any other required details:

   

3. Select Create and next to create the event group and go to the List of events for alerts page.

Add events to an event group

Now you can define the events associated with the event group. To add OPC UA events:

1. Select Add event.

2. Enter your event details:

   • Data source. This value is the event notifier from the OPC UA server.
   • Event name (Optional). This value is the friendly name that you want to use for the event. If you don't specify an event name, the event notifier is used as the event name.
   • Topic. The MQTT topic that you want the event to be published to.
   • Sampling interval (milliseconds). You can override the default value for this event.
   • Queue size. You can override the default value for this event.
   • Start instance. This value is the starting node for resolving relative browse paths for this event. This field is required if you use relative browse paths in the Data source field. For more information, see Resolve dynamic nodes by using browse paths.
   • Event filter. An optional configuration that selects and renames fields in the event notification. For more information, see Select and rename event fields.

   

3. Select Manage default settings to configure default event settings for the asset. These settings apply to all the OPC UA events that belong to the asset. You can override these settings for each event that you add. Default event settings include:

   • Publishing interval (milliseconds): The rate at which OPC UA server should publish data.
   • Queue size: The depth of the queue to hold the sampling data before publishing it.

To add an event group and events to an existing asset, use the az iot ops ns asset opcua event-group and az iot ops ns asset opcua event commands:

# Add an event group to the thermostat asset
az iot ops ns asset opcua event-group add \
  --data-source "" \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --name alerts \
  --dest topic="azure-iot-operations/events/test-thermostat-cli" retain=Never qos=Qos1 ttl=3600

# Add an event to the event group
az iot ops ns asset opcua event add \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --event-group alerts \
  --name serverObjectNotifier \
  --data-source "ns=0;i=2253"

# List the event groups for the asset
az iot ops ns asset opcua event-group list \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name}

When you add an event group by using the Azure CLI, you can configure:

• Event group name and data source
• Publishing interval and queue size
• Event destinations (MQTT topic, QoS, retain, TTL)

To add individual events to an event group, use the az iot ops ns asset opcua event add command with the --event-group parameter.

To remove an event group, use the az iot ops ns asset opcua event-group remove command.

To add events and event groups to an asset by using Bicep, include the eventGroups array in the asset properties. Each event group can contain an events array with individual events:

eventGroups: [
  {
    name: 'alerts'
    eventGroupConfiguration: '{"publishingInterval":1000,"queueSize":10}'
    events: [
      {
        name: 'serverObjectNotifier'
        dataSource: 'ns=0;i=2253'
        eventConfiguration: '{}'
        destinations: [
          {
            target: 'Mqtt'
            configuration: {
              topic: 'azure-iot-operations/events/test-thermostat-bicep'
              qos: 'Qos1'
              retain: 'Never'
              ttl: 3600
            }
          }
        ]
      }
    ]
  }
]

The eventGroupConfiguration property is a stringified JSON object that can include connector-specific settings such as publishingInterval and queueSize. Individual events use the eventConfiguration property for event-specific settings including per-event destinations.

Review your asset and OPC UA data point and event details. Make any adjustments you need:

To review your asset configuration, use the following commands:

# View the complete asset details
az iot ops ns asset show \
  --name thermostat \
  --instance {your instance name} \
  -g {your resource group name}

# List datasets and data points
az iot ops ns asset opcua dataset list \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name}

# List event groups
az iot ops ns asset opcua event-group list \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name}

To review your Bicep template before deployment, use the what-if operation:

az deployment group what-if --resource-group {your resource group name} --template-file asset.bicep

This command shows you what changes would be made to your Azure resources without actually deploying them.

Find and select the asset you created previously. Use the Asset details, data points, and Events tabs to make any changes:

On the view data points tab for a dataset, you can add data points, update existing data points, or remove data points.

To update a data point, select an existing data point and update the data point information. Then select Update:

To remove data points, select one or more data points and then select Remove data points:

You can also add, update, and delete events and properties in the same way.

When you're finished making changes, select Save to save your changes.

To list your assets associated with a specific endpoint, use the following command:

az iot ops ns asset query \
  --device {your device name} \
  --endpoint {your endpoint name} \
  -g {your resource group name} \
  --instance {your instance name}

To view the details of the thermostat asset, use the following command:

az iot ops ns asset show \
  --name thermostat \
  --instance {your instance name} \
  -g {your resource group}

To update an asset, use the az iot ops ns asset opcua update command. For example, to update the asset's description, use a command like the following example:

az iot ops ns asset opcua update \
  --name thermostat \
  --instance {your instance name} \
  -g {your resource group} \
  --description "Updated factory PLC"

To list the thermostat asset's data points in a dataset, use the following command:

az iot ops ns asset opcua dataset show \
  --asset thermostat \
  --name oven \
  -g {your resource group} \
  --instance {your instance name}

To list the thermostat asset's event groups, use the following command:

az iot ops ns asset opcua event-group list \
  --asset thermostat \
  -g {your resource group} \
  --instance {your instance name}

To add a new data point to the thermostat asset, use a command like the following example:

az iot ops ns asset opcua datapoint add \
  --asset thermostat \
  --instance {your instance name} \
  -g {your resource group name} \
  --dataset oven \
  --name humidity \
  --data-source "ns=3;s=FastUInt100"

To delete a data point, use the az iot ops ns asset opcua datapoint remove command.

You can manage an asset's event groups by using the az iot ops ns asset opcua event-group commands.

To retrieve an asset by using Bicep, use a template like the following example:

param deviceRegistryNamespaceName string = '<AIO_NAMESPACE_NAME>'

resource deviceRegistryNamespace 'Microsoft.DeviceRegistry/namespaces@2026-04-01' existing = {
  name: deviceRegistryNamespaceName
}

resource asset 'Microsoft.DeviceRegistry/namespaces/assets@2026-04-01' existing = {
  name: 'thermostat'
  parent: deviceRegistryNamespace
}

output asset object = asset

To update an existing asset, for example to modify the description and add a data point, use a template like the following example:

param deviceRegistryNamespaceName string = '<AIO_NAMESPACE_NAME>'
param customLocationName string = '<CUSTOM_LOCATION_NAME>'

resource deviceRegistryNamespace 'Microsoft.DeviceRegistry/namespaces@2026-04-01' existing = {
  name: deviceRegistryNamespaceName
}

resource customLocation 'Microsoft.ExtendedLocation/customLocations@2021-08-31-preview' existing = {
  name: customLocationName
}

resource asset 'Microsoft.DeviceRegistry/namespaces/assets@2026-04-01' = {
  name: 'thermostat'
  parent: deviceRegistryNamespace
  location: resourceGroup().location
  extendedLocation: {
    type: 'CustomLocation'
    name: customLocation.id
  }
  properties: {
    displayName: 'thermostat'
    description: 'Updated thermostat asset with voltage data point'
    enabled: true

    deviceRef: {
      deviceName: 'opc-ua-connector-bicep'
      endpointName: 'opc-ua-connector-0'
    }

    defaultDatasetsConfiguration: '{}'
    defaultEventsConfiguration: '{}'

    datasets: [
      {
        name: 'oven'
        datasetConfiguration: '{}'
        dataPoints: [
          {
            name: 'temperature'
            dataSource: 'ns=3;s=FastUInt10'
            dataPointConfiguration: '{}'
          }
          {
            name: 'humidity'
            dataSource: 'ns=3;s=FastUInt100'
            dataPointConfiguration: '{}'
          }
          {
            name: 'voltage'
            dataSource: 'ns=3;s=FastUInt101'
            dataPointConfiguration: '{}'
          }
        ]
        destinations: [
          {
            target: 'Mqtt'
            configuration: {
              topic: 'azure-iot-operations/data/thermostat'
              qos: 'Qos1'
              retain: 'Never'
              ttl: 3600
            }
          }
        ]
      }
    ]
  }
}

To delete an asset, select the asset you want to delete. On the Asset details page, select Delete. Confirm your changes to delete the asset:

To delete an asset, use a command that looks like the following example:

az iot ops ns asset delete \
  --name thermostat \
  -g {your resource group name} \
  --instance {your instance name}

To delete individual resources by using Bicep, see Deployment stacks.