Quickstart: Create and provision a simulated TPM device using C# device SDK for IoT Hub Device Provisioning Service

These steps show you how to use the Azure IoT Samples for C# to simulate a TPM device on a development machine running the Windows OS. The sample also connects the simulated device to an IoT Hub using the Device Provisioning Service.

The sample code uses the Windows TPM simulator as the Hardware Security Module (HSM) of the device.

If you're unfamiliar with the process of autoprovisioning, review the provisioning overview. Also make sure you've completed the steps in Set up IoT Hub Device Provisioning Service with the Azure portal before continuing.

The Azure IoT Device Provisioning Service supports two types of enrollments:

• Enrollment groups: Used to enroll multiple related devices.
• Individual Enrollments: Used to enroll a single device.

This article will demonstrate individual enrollments.

Prepare the development environment

1. Make sure you have the .NET Core 2.1 SDK or later installed on your machine.

2. Make sure git is installed on your machine and is added to the environment variables accessible to the command window. See Software Freedom Conservancy's Git client tools for the latest version of git tools to install, which includes the Git Bash, the command-line app that you can use to interact with your local Git repository.

3. Open a command prompt or Git Bash. Clone the Azure IoT Samples for C# GitHub repo:

   git clone https://github.com/Azure-Samples/azure-iot-samples-csharp.git
   

Provision the simulated device

1. Sign in to the Azure portal. Select the All resources button on the left-hand menu and open your Device Provisioning service. From the Overview blade, note the ID Scope value.

   

2. In a command prompt, change directories to the project directory for the TPM device provisioning sample.

   cd .\azure-iot-samples-csharp\provisioning\Samples\device\TpmSample
   

3. Type the following command to build and run the TPM device provisioning sample. Replace the <IDScope> value with the ID Scope for your provisioning service.

   dotnet run <IDScope>
   

   This command will launch the TPM chip simulator in a separate command prompt. On Windows, you may encounter a Windows Security Alert that asks whether you want to allow Simulator.exe to communicate on public networks. For the purposes of this sample, you may cancel the request.

4. The original command window displays the Endorsement key, the Registration ID, and a suggested Device ID needed for device enrollment. Take note of these values. You will use these value to create an individual enrollment in your Device Provisioning Service instance.

   Note

   Do not confuse the window that contains command output with the window that contains output from the TPM simulator. You may have to select the original command window to bring it to the foreground.

   

5. In the Azure portal, from the Device Provisioning Service menu, select Manage enrollments. Select the Individual Enrollments tab and select the Add individual enrollment button at the top.

6. In the Add Enrollment panel, enter the following information:

   • Select TPM as the identity attestation Mechanism.

   • Enter the Registration ID and Endorsement key for your TPM device from the values you noted previously.

   • Select an IoT hub linked with your provisioning service.

   • Optionally, you may provide the following information:

     • Enter a unique Device ID (you can use the suggested one or provide your own). Make sure to avoid sensitive data while naming your device. If you choose not to provide one, the registration ID will be used to identify the device instead.
     • Update the Initial device twin state with the desired initial configuration for the device.

   • Once complete, press the Save button.

     

   On successful enrollment, the Registration ID of your device will appear in the list under the Individual Enrollments tab.

7. Press Enter in the command window (the one that displayed the Endorsement key, Registration ID, and suggested Device ID) to enroll the simulated device. Notice the messages that simulate the device booting and connecting to the Device Provisioning Service to get your IoT hub information.

8. Verify that the device has been provisioned. On successful provisioning of the simulated device to the IoT hub linked with your provisioning service, the device ID appears on the hub's IoT devices blade.

   

   If you changed the initial device twin state from the default value in the enrollment entry for your device, it can pull the desired twin state from the hub and act accordingly. For more information, see Understand and use device twins in IoT Hub.

Clean up resources

If you plan to continue working on and exploring the device client sample, do not clean up the resources created in this quickstart. If you do not plan to continue, use the following steps to delete all resources created by this quickstart.

1. Close the device client sample output window on your machine.
2. Close the TPM simulator window on your machine.
3. From the left-hand menu in the Azure portal, select All resources and then select your Device Provisioning service. At the top of the Overview blade, press Delete at the top of the pane.
4. From the left-hand menu in the Azure portal, select All resources and then select your IoT hub. At the top of the Overview blade, press Delete at the top of the pane.

Next steps

In this quickstart, you’ve created a TPM simulated device on your machine and provisioned it to your IoT hub using the IoT Hub Device Provisioning Service. To learn how to enroll your TPM device programmatically, continue to the quickstart for programmatic enrollment of a TPM device.