How enrollment list in Azure IoT Hub Device Provisioning Service isolate tenant specific configuration?

Question

Some documentation and videos regarding Device Provisioning Service (DPS) says it can handle multitenancy but, it seem there is a confusion about how one tenant's configuration/data is isolated from other tenants. lets say I have 5 tenants and each of them having 1000 devices which I need to onboard to IoT hub of their respective tenant (assume I have one IoT hub per tenant). Enrollment group is a perfect thing to do in this situation but then do I have to create 5 enrollment list (one per tenant) and configure all the devices and their attestation mechanism in the list? if this is the right way then is the "attestation mechnism" makes difference in isolation of registering tenant's devices?

Some of the document also says tenant isolation is based on the ID scope of DPS, which means I need to create 5 DPS instances (one per tenant) and give this ID scope and registration URL in the registration software during manufacturing process? If that is the case wouldn't this be a mess to handle it at manufacturing step to encode ID scope for each tenant's device?

Answer 1

The answer is more or less same if you have seen this question Should there be one device provisioning service for one IoT hub if it is associated with one tenant?

Yes DPS isolates tenant configuration based on attestation mechanism. Let's say, if X509 certificate based attestation mechanism is used and there are 5 tenants. There will be single root CA for all the tenants and there will be unique intermediate certificate per tenant which are signed by this root CA. Now all the devices belong to specific tenant will use common intermediate certificate of the tenant for signing. This configuration should be created in DPS instance with one enrollment list per tenant.

In short, when device communicates to DPS it will identify itself from the available intermediate certificate uploaded in DPS initially and depending on this DPS will make sure that the device belongs to particular tenant and allows it connect to specific IoT Hubs configured in the list.