Azure IoT Hub over private delivery: Private Link for cellular devices

Updated 27 October 2026

Cellular devices reach Azure IoT Hub privately when private delivery brings their traffic into your virtual network over ExpressRoute or VPN Gateway, and the hub has a private endpoint in that network. Device-to-cloud messages then travel between private addresses, and the hub’s public endpoint can be closed. Microsoft describes the setup in IoT Hub support for virtual networks with Azure Private Link.

Status: Coming soon (checked 26 October 2026) · Notify me when available

Microsoft’s caveat, and why private delivery answers it

Microsoft writes that this setup mainly targets devices inside an on-premises network and “isn’t advised for devices deployed in a wide-area network”. Cellular devices normally sit on exactly such a wide-area network. Private delivery changes that: the mobile core network hands device traffic to your virtual network over ExpressRoute or a VPN Gateway, so for Azure the devices behave like an on-premises network with its own private address range.

Architecture

Device (MQTT 8883) ── private APN ── ExpressRoute or VPN Gateway ── VNet
                                                                    │
                                     IoT Hub private endpoint (private IP in a subnet)
                                     Private DNS zone privatelink.azure-devices.net
                                     Azure DNS Private Resolver inbound endpoint (device DNS)

Steps

1. Deliver SIM traffic into the virtual network: see private delivery into Azure.
2. Create the private endpoint for the hub (Networking, Private access, Create a private endpoint), in the same region as the hub, and integrate it with a private DNS zone.
3. Answer device DNS queries privately. The zone is privatelink.azure-devices.net (private endpoint DNS reference). Devices are outside Azure: create an Azure DNS Private Resolver inbound endpoint and use its address as the DNS server of the private APN, or forward the hub’s name to it.
4. Close the public side. Turn off public network access, or use the IP filter to block all addresses and apply the rule to the built-in endpoint too.
5. Keep routing working. If the hub routes messages to Storage, Event Hubs or Service Bus behind a firewall, give the hub a managed identity and enable the trusted Microsoft services exception, as Microsoft explains.

Ports

From IoT Hub communication protocols and ports:

Microsoft notes that 8883 and 5671 can be blocked on networks closed to non-HTTPS traffic. On a private APN you set those rules yourself.

Also worth knowing

• The built-in Event Hubs compatible endpoint gets its own private endpoint connection (the one with servicebus.windows.net in its name).
• Device identity does not change: symmetric keys or X.509 certificates work as before; only the network path is private.

The SIMs: IoT SIM cards. Event-driven MQTT on Azure: Event Grid MQTT broker.