Provisioning is the device’s first contact with the platform. It turns a factory-fresh unit holding only a bootstrap credential into a fully managed device with its own operational certificate and an initialised twin.
Zero-touch by design
No human configures the device. It connects, proves a provisioning claim, and is issued a unique operational certificate — so the bootstrap credential is never used for day-to-day traffic.
The device connects to the MQTT Broker using a limited bootstrap credential.
The Device Registry verifies the provisioning claim against the expected fleet.
The registry forwards the CSR to the CA Service, which returns a signed, device-specific certificate.
The twin is seeded with default desired state; the device reconnects using its
new operational certificate and is marked active.