Integrations: connect privately delivered devices to cloud IoT services

Private delivery brings device traffic into your cloud network; these guides show how it then reaches the IoT service your application uses, on private IP addresses, with the DNS and security settings each service needs. Each guide cites the cloud provider’s own documentation, checked on 27 October 2026.

The pattern is the same everywhere:

1. Device traffic arrives in your virtual network over AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect or IPsec.
2. The IoT service gets a private endpoint inside that network.
3. Device DNS queries for the service name are answered with the private endpoint address, not the public one.
4. The service’s public endpoint can then be closed.

• AWS IoT Core over private delivery: MQTT without the internet
  Connect cellular devices to AWS IoT Core through an interface VPC endpoint: no public internet path, private DNS, 100,000 devices per endpoint. Step by step.
• Azure IoT Hub over private delivery: Private Link for cellular devices
  Connect cellular devices to Azure IoT Hub through a private endpoint: ExpressRoute delivery, private DNS zone, public network access turned off. Step by step.
• Azure Event Grid MQTT broker over private delivery
  Run MQTT for cellular devices on the Azure Event Grid broker reached only through private endpoints: setup, DNS zone, MQTT versions and limits to plan for.
• Google Cloud Pub/Sub for cellular devices over private delivery
  Pub/Sub is not built for device clients and Google's private API addresses carry no MQTT. The private pattern: an MQTT broker in your VPC.
• Your own MQTT broker on private IPs for cellular devices
  Run Mosquitto or another MQTT broker on private addresses only, reached by SIMs over private delivery: listener binding, certificates, firewall rules and DNS.
• LwM2M device management over private delivery
  Manage NB-IoT and LTE-M devices with LwM2M over CoAP and DTLS on a private network: ports, server choice (Eclipse Leshan), firewall and NAT rules for UDP.