An IoT product is four things working together: a device that senses or acts, a connection, a cloud platform that identifies devices and moves their data, and an app that people use. Most of the difficulty is not in any one part but in the joins: getting devices onto the network securely, keeping them updated for years, and making the app behave when a device is offline. Choose the cloud platform for how it manages devices and security, keep your own data and logic portable, and plan for the regulations that now apply to connected products in the EU.
Key takeaways
- Microsoft's documentation describes IoT as connecting physical devices to exchange data over the internet, with "more than 10 billion connected devices worldwide".
- AWS IoT Core and Azure IoT Hub both give each device an identity, secure two-way messaging and routing of data to other cloud services; Azure supports authentication by SAS token or X.509 certificate.
- Google Cloud IoT Core was discontinued on 16 August 2023, which is a reminder to keep device logic portable.
- Matter 1.5 (November 2025) added cameras, closures such as shades and garage doors, soil sensors and energy management; Matter 1.5.1 followed in March 2026.
- The EU Cyber Resilience Act entered into force on 10 December 2024; its reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027.
What is IoT, in plain words?
The Internet of Things is physical devices, such as sensors, meters, locks and machines, that send data to software and can be controlled by it. Microsoft's documentation notes how different these devices are from browsers or phones: they are often embedded with no human operator, deployed in remote places, limited in power and processing, and connected over slow, intermittent or expensive networks. Everything in an IoT design follows from those limits.
How does an IoT system fit together?
| Part | What it does | Things to decide |
|---|---|---|
| Device | Senses, acts and runs small firmware | Hardware, power, how it is updated |
| Connectivity | Carries data to the cloud | Wi-Fi, Thread, Bluetooth Low Energy or cellular; the messaging protocol, often MQTT |
| Cloud platform | Registers devices, authenticates them, moves messages | Which platform, how devices are provisioned |
| Data and logic | Stores readings, applies rules, raises alerts | What is stored, for how long, who can see it |
| Mobile and web app | Sets up, controls and monitors devices | Platform, offline behaviour, notifications |
| Security and updates | Keeps devices and data safe over their lifetime | Identity per device, signed updates, vulnerability handling |
How do you choose an IoT platform?
Two major platforms show what to look for.
- AWS IoT Core. Its Device Gateway keeps long-lived, bidirectional connections for MQTT and WebSockets clients. The Device Shadow stores each device's last reported state and desired state, even while the device is offline, and the Rules Engine evaluates messages and routes them to other devices or cloud services using rules you define. Billing is separate for connectivity, messaging, shadow, registry and rules usage.
- Azure IoT Hub. A managed service that acts as a central message hub between an IoT application and its devices, with an identity registry of permitted devices. Devices authenticate with SAS tokens or X.509 certificates; Microsoft describes certificates as the more secure and scalable option. It supports device-to-cloud messages, file uploads and request-reply commands, and can route data to services such as Storage, Event Hubs and Cosmos DB.
- A lesson from Google. Google Cloud IoT Core was discontinued on 16 August 2023 and stopped accepting new customers. Teams that had built directly on it had to move.
Compare platforms on five factors:
- Device management: registering, provisioning and updating thousands of devices.
- Architecture fit: how well it works with the rest of your cloud and your data tools.
- Integration: the services you can connect to, and how easily.
- Security: per-device identity, encryption and access control.
- Connectivity: the protocols and networks your devices need.
Keep your own business logic and data model separate from any platform's specific features so a move stays possible. If your cloud is already on one provider, the platform on the same provider is usually the simplest start; we cover AWS in our AWS development work.
What does the mobile app do?
The app is where most people meet your product. It sets devices up (often over Bluetooth Low Energy), shows state, sends commands and delivers alerts. Design for the device being offline, slow or not yet connected, and show the last known state instead of an error. For home and building products, the Matter standard from the Connectivity Standards Alliance lets devices from different makers work together. Matter 1.5, released in November 2025, added cameras (including video doorbells), closures such as window shades, gates and garage doors, soil sensors and energy management features, and Matter 1.5.1 in March 2026 refined camera and doorbell support. For choosing between native and cross-platform for the app, see Cross-platform or native in 2026, and for the mobile technologies behind it, Mobile app technologies in 2026.
What do security and the law require?
Connected products are now regulated. This is general information, not legal advice, and it covers the EU only. The Cyber Resilience Act covers software and hardware products with digital elements and sets mandatory cybersecurity requirements for manufacturers across planning, design, development and maintenance. Products must be designed, updated and maintained to protect users, and manufacturers must handle vulnerabilities during the product's lifecycle. The Act entered into force on 10 December 2024; its reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027.
In practice, plan for a unique identity for each device, encrypted connections, a way to deliver signed updates for the whole life of the product, and a process to receive and fix vulnerability reports.
How should you start?
- Pick one device and one workflow, such as "alert me when this temperature goes out of range".
- Choose the connectivity and the platform using the five factors above.
- Build the app against a simulated device first, then a real one.
- Test failure: lost connection, a dead battery, a wrong password during setup.
- Plan updates and security from day one, not after launch.
- Measure what people do, then extend.
If you need a team, How to hire an app development company in 2026 explains what to check. Our app development page describes the app and cloud work we do.
FAQ
What is the difference between IoT and a normal app?
A normal app talks to a server. An IoT app also depends on physical devices that may be offline, battery-powered and out of reach, so setup, state and updates need much more design.
Which protocol do IoT devices use?
Many use MQTT, a lightweight publish and subscribe protocol, over Wi-Fi, cellular or other links. AWS IoT Core and Azure IoT Hub both support MQTT. Home products increasingly use Matter, which runs over Wi-Fi and Thread.
Do we need an IoT platform from a cloud provider?
Not always, but a managed platform gives you device identity, messaging and routing without building them. Keep your business logic portable so you can change platform later.
Does the EU Cyber Resilience Act apply to us?
It applies to manufacturers of products with digital elements sold in the EU, and obligations phase in from 11 September 2026 (reporting) and 11 December 2027 (main obligations). Check your own position with a lawyer.
How long should we keep a device supported?
Plan updates for as long as the device is in use. The Cyber Resilience Act expects products to be maintained to protect users and vulnerabilities handled throughout the lifecycle.
Sources
- Microsoft Learn, "What is Azure IoT Hub?": https://learn.microsoft.com/en-us/azure/iot-hub/iot-concepts-and-iot-hub
- AWS, "AWS IoT Core features": https://aws.amazon.com/iot-core/features/
- Google Cloud, "Google Cloud Platform Services Summary" (IoT Core discontinued 16 August 2023): https://cloud.google.com/terms/services/index-20230712
- Connectivity Standards Alliance, "Matter 1.5 Introduces Cameras, Closures, and Enhanced Energy Management Capabilities": https://csa-iot.org/newsroom/matter-1-5-introduces-cameras-closures-and-enhanced-energy-management-capabilities/
- Connectivity Standards Alliance, "Matter 1.5.1: Enhancing Camera Performance and Expanding Device Flexibility": https://csa-iot.org/newsroom/matter-1-5-1-enhancing-camera-performance-and-expanding-device-flexibility/
- European Commission, "Cyber Resilience Act": https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
