|
| 1 | +--- |
| 2 | +title: Firmware analysis integration with Azure Device Registry |
| 3 | +description: Learn about how firmware analysis results are mapped to deployed devices and assets in Azure Device Registry. |
| 4 | +author: karengu0 |
| 5 | +ms.author: karenguo |
| 6 | +ms.topic: conceptual |
| 7 | +ms.date: 04/10/2026 |
| 8 | +ms.service: azure |
| 9 | +--- |
| 10 | + |
| 11 | +# Using Firmware analysis along with Azure Device Registry |
| 12 | + |
| 13 | +Azure Device Registry maintains an inventory of two types of resources: Assets and Devices. Firmware images will be mapped to both types of Azure Device Registry resources. |
| 14 | + |
| 15 | +- Assets are managed by Azure IoT Operations |
| 16 | + - An example of an asset managed by Azure IoT Operations could be an oven in a bakery. |
| 17 | +- Devices are managed by Azure IoT Hub (preview) and Azure IoT Operations |
| 18 | + - Examples of devices managed by Azure IoT Hub could be cameras or wind turbines. |
| 19 | + |
| 20 | +Firmware analysis and Azure Device Registry operate as complementary Azure services. Firmware analysis evaluates the security of firmware images, while Azure Device Registry tracks deployed devices and assets and their associated metadata. To learn more about Azure Device Registry, visit [Integration with Azure Device Registry (preview)](./../iot-hub/iot-hub-device-registry-overview.md). |
| 21 | + |
| 22 | +The Firmware analysis and Azure Device Registry integration associates firmware analysis results with Azure Device Registry managed devices and assets based on shared metadata values. This association enables users to have a comprehensive understanding of the security posture of the firmware across your Azure Device Registry-managed devices fleet. With this integration, you can now know which devices are impacted by critical vulnerabilities in your firmware images and take the necessary actions to remediate risk across your Azure Device Registry device fleet. |
| 23 | + |
| 24 | + |
| 25 | +## Metadata-based association |
| 26 | + |
| 27 | +Firmware analysis associates firmware images with Azure Device Registry devices and assets by matching firmware metadata defined during firmware upload with Azure Device Registry resource metadata. This association occurs at the subscription level. Firmware analysis matches Azure Device Registry devices and assets in the same subscription as the Firmware analysis workspace. |
| 28 | + |
| 29 | +When a firmware image is uploaded to Firmware analysis, the following metadata is specified: |
| 30 | + |
| 31 | +- Vendor |
| 32 | +- Model |
| 33 | +- Firmware version |
| 34 | + |
| 35 | +Azure Device Registry maintains corresponding metadata for devices and assets. This integration establishes associations between firmware analysis results and Azure Device Registry resources by matching these metadata fields across both services. |
| 36 | + |
| 37 | +The following metadata values are used to associate firmware images with Azure Device Registry resources: |
| 38 | + |
| 39 | +| Firmware analysis metadata | Corresponding Azure Device Registry resource metadata | |
| 40 | +|----------------------------|-------------------------------------| |
| 41 | +| Vendor | Manufacturer | |
| 42 | +| Model | Model | |
| 43 | +| Version | Operating system version (Devices) or Software revision (Assets) | |
| 44 | + |
| 45 | +When metadata values match between a firmware image and an Azure Device Registry device or asset, the Azure Device Registry resource is associated with that firmware image for the purpose of reporting firmware analysis results for that Azure Device Registry resource. |
| 46 | + |
| 47 | + |
| 48 | +## Ensure metadata in Firmware analysis and Azure Device Registry match each other |
| 49 | + |
| 50 | +Because the firmware images are mapped to the Azure Device Registry resources and vice versa using metadata from both, be sure to keep your metadata fields up-to-date so that the list of Azure Device Registry resources associated with each firmware image is comprehensive. |
| 51 | + |
| 52 | +To update your metadata fields in Firmware analysis, navigate to your firmware image in Firmware analysis, and edit the metadata fields. |
| 53 | + |
| 54 | +:::image type="content" source="media/device-registry-integration/update-metadata.png" alt-text="Screenshot of the update metadata icon." lightbox="media/device-registry-integration/update-metadata.png"::: |
| 55 | + |
| 56 | +To update your metadata fields in Azure Device Registry for your Azure Device Registry Devices, run the following command: |
| 57 | + |
| 58 | +```azurecli |
| 59 | +az rest --method patch \ |
| 60 | + --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeviceRegistry/namespaces/{namespaceName}/devices/{deviceName}?api-version={apiVersion}" \ |
| 61 | + --headers "Content-Type=application/json" \ |
| 62 | + --body "{ |
| 63 | + \"properties\": { |
| 64 | + \"operatingSystemVersion\": \"{operatingSystemVersion}\", |
| 65 | + \"enabled\": {true|false} |
| 66 | + } |
| 67 | + }" |
| 68 | +``` |
| 69 | + |
| 70 | +To confirm that your metadata fields were updated as expected, run the following command: |
| 71 | + |
| 72 | +```azurecli |
| 73 | +az rest --method get \ |
| 74 | + --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeviceRegistry/namespaces/{namespaceName}/devices/{deviceName}?api-version={apiVersion}" |
| 75 | +``` |
| 76 | + |
| 77 | +To update your metadata fields in Azure Device Registry for your Azure Device Registry Assets, visit the Digital Operations Experience. For more information, see [Manage resources in the operations experience UI - Azure IoT Operations](./../iot-operations/discover-manage-assets/howto-use-operations-experience.md). |
| 78 | + |
| 79 | + |
| 80 | +## Where to find Azure Device Registry resource information in Firmware analysis |
| 81 | + |
| 82 | +Firmware analysis surfaces Azure Device Registry device and asset information associated with a firmware image in the following areas: |
| 83 | + |
| 84 | +- Firmware image list view in a Workspace |
| 85 | + Includes a Devices & assets column that shows the number of Azure Device Registry-managed resources associated with that firmware image |
| 86 | + |
| 87 | +- Firmware Overview right-hand pop-up in firmware list |
| 88 | + Displays two fields: “Devices” and “Assets” count associated with the firmware image |
| 89 | + |
| 90 | + :::image type="content" source="media/device-registry-integration/devices-assets-firmware-list-popup.png" alt-text="Screenshot of the Devices and Assets list in the firmware list popup." lightbox="media/device-registry-integration/devices-assets-firmware-list-popup.png"::: |
| 91 | + |
| 92 | + - Hover over the number to see a scrollable list of Azure Device Registry Devices or Assets, each linking to that Azure Device Registry resource’s Resource Overview page in the Azure Device Registry portal |
| 93 | + |
| 94 | +- Analysis results Azure Device Registry section |
| 95 | + - Azure Device Registry fields “Devices” and “Assets” that displays Azure Device Registry-associated devices and assets alongside firmware analysis findings |
| 96 | + |
| 97 | + :::image type="content" source="media/device-registry-integration/devices-assets-firmware-details.png" alt-text="Screenshot of the Devices and Assets fields in firmware analysis findings." lightbox="media/device-registry-integration/devices-assets-firmware-details.png"::: |
| 98 | + |
| 99 | + - Like the experience in the Overview panel pop-up, hover over the number to see a scrollable list of Azure Device Registry resources, each linking to that resource’s Resource Overview page in the Azure Device Registry portal |
| 100 | + |
| 101 | + :::image type="content" source="media/device-registry-integration/hover-list.png" alt-text="Screenshot of the scrollable list upon hovering over Azure Device Registry resources." lightbox="media/device-registry-integration/hover-list.png"::: |
| 102 | + |
| 103 | +From Firmware analysis, you can select an Azure Device Registry resource to be taken to the Azure Device Registry resource overview page in the Azure Device Registry portal. |
| 104 | + |
| 105 | +--- |
| 106 | + |
| 107 | +## Access requirements |
| 108 | + |
| 109 | +Access to Azure Device Registry associated device and asset information is governed by Azure role based access control (RBAC). |
| 110 | + |
| 111 | +Firmware analysis roles do not automatically grant access to Azure Device Registry resources. Users of Firmware analysis with the Firmware Analysis Admin role do not have proper permissions to view the list of Azure Device Registry devices. Users must also have appropriate Azure Device Registry permissions to view: |
| 112 | + |
| 113 | +- Azure Device Registry device lists |
| 114 | +- Azure Device Registry asset metadata |
| 115 | +- Azure Device Registry resource details in the Azure Device Registry portal |
| 116 | + |
| 117 | +Azure Device Registry-associated information might not be visible if the user does not have the required Azure Device Registry permissions, even when metadata values match. Ensure you have both of the following roles: |
| 118 | + |
| 119 | +- Azure Device Registry Contributor, which allows you to read Azure Device Registry namespaces |
| 120 | +- Azure IoT Operations Administrator, which allows you to read Azure Device Registry Assets and Devices in the Azure Device Registry namespaces |
| 121 | + |
| 122 | +Additionally, the Reader role at the subscription level allows you to read both namespaces and Azure Device Registry Assets and Devices. |
| 123 | + |
| 124 | +| Role | Permission to read namespaces? | Permission to read Azure Device Registry Assets? | Permission to read Azure Device Registry Devices? | |
| 125 | +|------------------------------------|--------------------------------|--------------------------------|---------------------------------| |
| 126 | +| Azure Device Registry Contributor | Yes | No | Yes | |
| 127 | +| Azure IoT Operations Administrator | No | Yes | Yes | |
| 128 | +| Reader | Yes | Yes | Yes | |
| 129 | + |
| 130 | +Ensure you have the Firmware Analysis Admin role in addition to the appropriate Azure Device Registry roles to see Azure Device Registry-associated information. |
| 131 | + |
| 132 | +## Why am I not seeing any Azure Device Registry Devices or Assets? |
| 133 | + |
| 134 | +If Azure Device Registry device or asset counts are not visible for a firmware image, it may be due to one of the following: |
| 135 | + |
| 136 | +- Insufficient permissions – Your Azure role may not have permission to read Azure Device Registry devices and/or assets. In this case, counts may appear blank (–) or partially populated. |
| 137 | + |
| 138 | +- Missing firmware metadata – Azure Device Registry correlation requires Vendor, Model, and Version fields. If these are not populated accurately in both Firmware analysis and Azure Device Registry, device and asset usage cannot be determined. |
| 139 | + |
| 140 | +- Temporary query failure – Azure Device Registry results are retrieved using Azure Resource Graph (ARG). Counts may appear empty if a query error occurs. Refreshing the page might resolve this. |
| 141 | + |
| 142 | + |
| 143 | +## Current limitations |
| 144 | + |
| 145 | +The initial preview version of this integration: |
| 146 | + |
| 147 | +- Displays Azure Device Registry device and asset count |
| 148 | +- Displays results by using Azure Resource Graph. Changes to metadata for Azure Device Registry Devices and Assets might take a few minutes to appear in Firmware analysis |
| 149 | +- Provides navigation to individual Azure Device Registry resources instead of a pre-filtered Azure Device Registry device list view |
0 commit comments