title: How to generate an Azure IoT hub SAS token for one device/service only?
body: <p>I want to generate a new SAS token for accessing an Azure IoT Hub using Paho MQTT with Java. I want to retrieve MQTT messages from a backend Java service.</p>
  
  <p>Of course I want to limit the access for each service instance to certain devices.</p>
  
  <p>This is the command I use to generate the token.</p>
  
  <p><code>az iot hub generate-sas-token -d device1 -n iothubname --policy device</code></p>
  
  <p>This is the error message I get </p>
  
  <pre><code>{u'ExceptionMessage': u'Tracking ID&lt;HIDDEN`enter code here`&gt;:TimeStamp:01/01/2019 14:30:33', u'Message': u'ErrorCode:IotHubUnauthorizedAccess;Unauthorized'}
  </code></pre>
  
  <p>Before I tried that, I tried to use the policy "service" (because that token should be used by the backend service) which didn't work either: </p>
  
  <pre><code>az iot hub generate-sas-token -d device1 -n iothubname --policy service
  
  </code></pre>
  
  <pre><code>{u'ExceptionMessage': u'Tracking ID:&lt;&gt;TimeStamp:01/01/2019 14:37:39', u'Message': u'ErrorCode:IotHubUnauthorizedAccess;Unauthorized'}
  </code></pre>
  
  <p>The only thing that works is <code>az iot hub generate-sas-token -n iothubname</code> but regarding the documentation this creates a token with the iothubowner policy which I don't want to give my backend service.</p>
  
  <p>I can't really understand the concept of permissions on the Azure IoT Hub even after reading the docs 3 times: <a href="https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-security#iot-hub-permissions" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-security#iot-hub-permissions</a></p>
  
  <p>When would I use the <code>service</code> policy and when would I use the <code>device</code> policy?</p>
  
  <p>Thanks!</p>