Azure IoT Hub device connect through Application Gateway

Question

Azure IoT Hub device connect through Application Gateway

Craig Webb 5

I have a requirement for allowing a c# service deployed to a customer PC to connect to our Azure components.
Currently they are all routed through an Application Gateway.

I would like to expand our features in Azure and add IoT Hub so the service can also be a device connecting to IoT Hub.

Is it possible to route the IoT Hub traffic through Application Gateway.
I have tried MQTT over Websocket, and turning on the Preview feature off Application Gateway to proxy TCP and TLS traffic.
Thus far I have not been able to establish a connection when routing through Application Gateway.

Craig Webb 5 Reputation points

2025-05-28T20:39:10.37+00:00

Hi,

Thanks for the response.
I do have the direct connection option working over MQTT.

However I was hoping to have a custom domain for IoT Hub, or even better to be able to continue using the custom domain I already have assigned to the Application Gateway.

If there is a way to get that to work using Iot Edge, or some other DNS configuration in Azure then I would much appreciate that solution.

Currently my options are

A) The customer will need to whitelist the IoT hub domain and ports (In my opinion the fixed domain isn't very professional when I need to share it with a customer), assuming they will even accept this change, they are very tight on security.

B) Not use IoT Hub and instead implement my own WebSocket through Application Gateway and basically replicate all the features I was getting with IoT Hub myself. I would prefer not to go this route.

Regards Craig
VSawhney 880 Reputation points Microsoft External Staff Moderator

2025-05-30T11:58:19.0133333+00:00

Hello Craig Webb,

Thank you for replying.
If whitelisting Azure IOT hub endpoints and ports fixes the issue, we should go for it instead of doing hercules task of replicating all IOT hub features through websocket.

Thank you!
VSawhney 880 Reputation points Microsoft External Staff Moderator

2025-06-03T06:09:39.7733333+00:00

Hello Craig Webb,

Following up to check if the response provided helped you. Please feel free reach us for further help.

Thank you!
Craig Webb 5 Reputation points

2025-06-03T21:29:12.2066667+00:00

Hi sorry for the late reply.

Currently I am discussing with the customer about whitelisting the additional domain\ports.
This is not a terrible solution for me, however if IoTHub supported custom domains then it would be better for us as we already have domains that are whitelisted by the customer.

This is probably the best solution available right now.

2 answers

Your answer

Craig Webb 5 Reputation points

2025-05-28T20:39:10.37+00:00

Hi,

Thanks for the response.
I do have the direct connection option working over MQTT.

However I was hoping to have a custom domain for IoT Hub, or even better to be able to continue using the custom domain I already have assigned to the Application Gateway.

If there is a way to get that to work using Iot Edge, or some other DNS configuration in Azure then I would much appreciate that solution.

Currently my options are

A) The customer will need to whitelist the IoT hub domain and ports (In my opinion the fixed domain isn't very professional when I need to share it with a customer), assuming they will even accept this change, they are very tight on security.

B) Not use IoT Hub and instead implement my own WebSocket through Application Gateway and basically replicate all the features I was getting with IoT Hub myself. I would prefer not to go this route.

Regards Craig
VSawhney 880 Reputation points Microsoft External Staff Moderator

2025-05-30T11:58:19.0133333+00:00

Hello Craig Webb,

Thank you for replying.
If whitelisting Azure IOT hub endpoints and ports fixes the issue, we should go for it instead of doing hercules task of replicating all IOT hub features through websocket.

Thank you!
VSawhney 880 Reputation points Microsoft External Staff Moderator

2025-06-03T06:09:39.7733333+00:00

Hello Craig Webb,

Following up to check if the response provided helped you. Please feel free reach us for further help.

Thank you!
Craig Webb 5 Reputation points

2025-06-03T21:29:12.2066667+00:00

Hi sorry for the late reply.

Currently I am discussing with the customer about whitelisting the additional domain\ports.
This is not a terrible solution for me, however if IoTHub supported custom domains then it would be better for us as we already have domains that are whitelisted by the customer.

This is probably the best solution available right now.

Answer 1

Hello Craig Webb,

It sounds like you're trying to connect a C# service on a customer PC to Azure IoT Hub while routing through an Application Gateway.

This isn’t directly supported because the IoT Hub uses specific protocols that the Application Gateway isn't designed to handle effectively, especially with MQTT and WebSocket communications.

Here are a few things you can try:

Direct Connection: Instead of routing through the Application Gateway, consider allowing direct connections to the IoT Hub from your C# service. This is the simplest way to ensure that the service can communicate effectively using MQTT or MQTT over WebSocket. https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-protocols
Use IoT Edge as field Gateway: If your architecture needs to use an Application Gateway for other reasons (e.g., security, logging), consider deploying an IoT Edge device that can act as a proxy. The IoT Edge device would be responsible for managing the connection from downstream devices to the IoT Hub.

https://learn.microsoft.com/en-us/azure/iot-edge/iot-edge-as-gateway

Hope this helps you get closer to a solution!
Thank you!

Answer 2

Sander van de Velde | MVP 36,941 MVP Volunteer Moderator

Hello @Craig Webb ,

welcome to this moderated Azure community forum.

The Azure IoT Hub offers a cloud gateway for devices using protocols like MQTT, AMQP and the websocket alternatives. Techically, HTTP calls are also supported but this is not recommended because it has functional limitations . Do not use the HTTP calls.

I have never encountered the combination of an Application Gateway and the Azure IoT Hub.

The Azure IoT hub has its own mechanisms to eg. load balance (using the separate Device Provisioning Service) or securing the access (eg. using private endpoints), or using the edge solution to separate local traffic with cloud traffic.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Craig Webb 5 Reputation points

2025-05-28T20:34:57.9066667+00:00
Hi thanks for the response.
The reason I am wanting to do this is for two reasons

Azure IoT Hub currently doesn't support custom domains. There is an open request from 8 years ago and to this day still hasn't been made available, even though it is marked as coming soon by Microsoft.

We have an Application Gateway running in our production environment which has a custom domain. Our customers ZScaler configuration already has firewall rules in place for that domain. So if I can continue to route the IoT traffic on that domain then it would simplify the customers configuration changes (They are a large organization and prefer to keep these changes to a minimum).

Share via

Azure IoT Hub device connect through Application Gateway

2 answers

Your answer