Device provisioning
Provisioning is the device’s first contact with the platform. It turns a factory-fresh unit holding only a bootstrap credential into a fully managed device with its own operational certificate and an initialised twin.
Zero-touch by design
No human configures the device. It connects, proves a provisioning claim, and is issued a unique operational certificate — so the bootstrap credential is never used for day-to-day traffic.
Participants
Device Registry
Validates the claim and creates the device record.
CA Service
Signs the device’s certificate request.
Twin Store
Holds the device’s initial desired/reported state.
Steps
Connect with bootstrap credential
The device connects to the MQTT Broker using a limited bootstrap credential.
Validate the claim
The Device Registry verifies the provisioning claim against the expected fleet.
Issue an operational certificate
The registry forwards the CSR to the CA Service, which returns a signed, device-specific certificate.
Initialise the twin and reconnect
The twin is seeded with default desired state; the device reconnects using its
new operational certificate and is marked active.