Linking your Azure Sphere device to a work account

Hi Steve,

yes, the device stays with the tenant. So if you no longer own that tenant then you no longer have control over the board.

https://docs.microsoft.com/en-us/azure-sphere/install/claim-device

https://social.msdn.microsoft.com/Forums/en-US/cac9e928-8dd1-407b-88c2-f790c1df44bc/why-leave-the-device-claim-as-one-ti…

The documents suggest that you must link it to your school or work system but I have a private Azure Account with AD and it seems to work fine.

I thought so. That seems like something that Microsoft and AVNET should warn people about. Particularly hobbyists, who might use their work AD to claim their Sphere device for convenience and then find they have a potentially useless device if they change jobs.

As you say, you can have a private Microsoft account and create an associated user identity and directory to use with Azure Sphere if you sign up to Microsoft Azure. I would certainly recommend this route unless people are planning on using their Sphere as part of their work.

Thanks for the quick reply.

You can attach it to a personal Azure account. You'll probably find that there's an extra step where you have to create a new user and log on as that. I've made some notes / screenshots on how I did this on case I'm selected to road test one. I'll post details later when I get a chance, but Microsoft document this pretty well.

This is the info for creating a new user for your Azure Sphere: https://docs.microsoft.com/en-us/azure-sphere/install/azure-directory-account#create-a-new-account-and-directory-that-ar…

It's not the clearest to be honest. And note that your user will have to have the same domain name as your directory - e.g. azuresphere@yourdirectory.onmicrosoft.com

The idea is that since they are secure devices, they are not meant to be passed around.

Since these are prototype devices, they are never intended to be used in a production environment. 

So you build your prototype, then build a custom board that does just want you need.

Those boards will each get a Sphere module.  When they are activated, they should be secure for the lifetime of the product. 

This already happens in our world today.  Your LG appliance can never become a GE appliance.

We in the IoT world usually apply security last, so building a thing then giving it to a client is easy.

This device starts with Security first, and then worries about the rest.

Hope this helps,

Harold

In your scenario, the customer needs to know how to activate the production board using their own AD. It's not that straightforward with this device. I understand the principle behind it but I think it is flawed.

1. Developers often configure a device and send it to a client for testing and then to put into production. Using their own Azure AD to claim the device being tested means that the client won't have control of it.
2. Students might buy a device whilst enjoying a college-supplied Microsoft account. Then, when they leave, the device could become useless. If they bought it with their own money, $70 or so is lot to sacrifice.

I think that Microsoft need to consider how a device can be released from one Azure AD tenant and claimed by another.

No, it's not intended for the end user to link it to their AD. You would link it to yours and then you are responsible for providing your customer with updates to your code. Microsoft would provide the updates to the underlying systems.

Azure Sphere – First Step (The device is not responding – An unexpected problem occurred. Please try again; if the issue persists, please refer to aka.ms/azurespheresupport)

https://rzetelnekursy.pl/azure-sphere-first-step-the-device-is-not-responding-an-unexpected-problem-occurred-please-try-again-if-the-issue-persists-please-refer-to-aka-msazurespheresupport/