Securing Smart Access: Integrating Microsoft Entra Verified ID with Azure IoT Hub and Home Assistant

cover

Building a Zero-Trust Door Access System with Verifiable Credentials

In this post, we’ll explore how to create a secure, decentralized access control system that combines Microsoft Entra Verified ID with Azure IoT Hub to unlock smart doors via Home Assistant. This solution demonstrates how verifiable credentials can bridge identity verification with physical access control in a zero-trust architecture.

The Challenge

Traditional access control systems rely on:

  • Physical keys — easily lost or copied
  • PIN codes — often shared and forgotten
  • Complicated and expensive — temporary access and visitor credentials
  • custom-developed protocols — old, vulnerable, and hard to adapt to new requirements

What if we could leverage decentralized identity and verifiable credentials to create a more secure, privacy-preserving access system? What if we could use protocol and not reinvent the wheel?

Why Verified ID?

  • Open Standard: Built on top of the OpenID Connect and JSON Web Token standards
  • Zero-Trust: Every access request requires cryptographic proof of identity
  • Standards-Based: OpenID for Verifiable Credentials is an open standard
  • FaceCheck: Biometric verification ensures the credential holder is present
  • Audit Trail: Complete logging of all access events in Verified ID Audit Log, extensible with custom solutions
  • Revocable: Credentials can be revoked at any time
  • Easy to Use and Share: Credentials can be issued to employees or external users via a dedicated portal
  • Temporary access: Issue, Present, and Revoke credentials for time-limited access
  • Partner Access: Easy trust and control for partners and customers.

Solution Overview

Our architecture combines several Azure services and open-source technologies:

Solution Architecture

General UI Flow and Screenshots

Custom Page to check Device Twin status: issue

Build-in revocation revoked

Solution Approaches

Solution 1: Verified Employee Access

  1. Issue credentials – Employees receive Verified ID credentials through the Microsoft MyAccount portal.
  2. Authorize access – A unified API validates credentials and grants device access via SDK integration.
  3. Manage device state – Azure IoT Hub syncs door lock status with the building management system.
  4. Control physical access – Smart door locks respond to authorized credential presentations.

Flow Diagram

Sequence Diagram

UI Flow and Screenshots

Custom Page to Issue Verified Employee. MyAccount

Solution 2: Customer or Partner Access

  1. Authenticate users – Customers or partners sign in through a branded portal secured by Entra External ID.
  2. Issue credentials – The portal issues Verified ID credentials to authenticated external users.
  3. Authorize access – A unified API validates credentials and grants device access via SDK integration.
  4. Manage device state – Azure IoT Hub syncs door lock status with the building management system.
  5. Control physical access – Smart door locks respond to authorized credential presentations.

UI Flow and Screenshots

Custom Page to Issue Verified ID Credentials with helper how to store it: issue

Custom Page to present Verified ID Credentials and unlock the door: issue

Possible Extensions

  • Admin Panel to review Device Twin status
  • Admin Panel to review Audit Logs
  • Visitor Management for time-limited access credentials
  • Visitor Automations for temporary access control
  • Face Recognition to improve security

Ask for a face check (MS Authenticator): issue

Technology Stack

ComponentTechnologyBusiness Purpose
Workforce IdentityMicrosoft Entra IDManage employee authentication and access rights
Customer IdentityMicrosoft Entra External IDManage external user authentication and self-service registration
Digital CredentialsMicrosoft Entra Verified IDIssue and verify tamper-proof access credentials
Backend ServicesAzure App Service (.Net)Process access requests and coordinate system components
Data StorageAzure Cosmos DBStore account information, credential metadata, and audit trails
Device ManagementAzure IoT HubMonitor and communicate with connected access points
User PortalStatic Web Site (React/TypeScript)Enable credential presentation and user self-service
Building AutomationHome AssistantBridge cloud services to on-premises door controllers
Smart LockPhysical DeviceGrant or deny physical entry based on validated credentials

Summary

By combining Microsoft Entra Verified ID with Azure IoT Hub, we’ve created a modern access control system that:

  1. Eliminates traditional credentials — no keys, cards, or PINs to lose
  2. Provides cryptographic proof — open standards and zero-trust architecture
  3. Enables real-time monitoring — dashboard & audit log shows authorization and access events
  4. Integrates with existing smart home — works with the Home Assistant ecosystem via MQTT integration

What next?

This architecture can be extended to other use cases:

  • Building/Security areas/Remote access control
  • Secure equipment access
  • Time-limited visitor access
  • Access for partners or vendors

Resources