Check your Central app

Create a read-only role in Central, paste its token, and see what moves to Helin Platform. The check runs in your browser and only reads.

Create the read-only role

An IoT Central application administrator prepares this access once. Azure subscription Owner access alone does not grant these application permissions.

  1. In your Central application, open Permissions > Roles > New. Create an Application role, for example Assignment full read, rather than an Organization role.
  2. Enable the View permissions below, keeping any dependencies Central selects automatically. These are the required read-access checklist, not an export of your existing role settings.
Check role permission checklist
Permission categoryAccessNeeded to read
Device templatesViewModels and behavior contracts
Device instancesViewDevice inventory and representative property snapshots
Device groupsViewGroup definitions and pilot scope
JobsViewExisting job definitions and status
Organization managementViewVisible organization hierarchy
Custom rolesViewRole names and IDs
Data exportViewExport definitions and destinations
Application dashboardsViewOptional: dashboard tiles for the Grafana translation
Edge deployment manifestsRead instanceOptional: edge modules and their desired configuration
User managementViewOptional: users and role assignments (contains email addresses)
Device connectivity managementRead instanceOptional: enrollment groups. The page redacts keys and certificates, but Central sends them to the browser, so skip this row if that is not acceptable
  1. Save the role. Under Permissions > API tokens > New, select this role and the root application organization for an application-wide check. Copy the generated token; Central only displays it once.
  2. Paste your application URL and token below. After the run, check What we could not read: it should not appear, which means no HTTP 403 errors. Reconcile visible devices and organizations against your intended scope.
  3. Review or download the report, then revoke the token when it is no longer needed. Do not send the token in chat, email or exported evidence.

The check does not need Create, Update, Delete, Execute commands or token-management permissions. Device credentials are only reachable through the optional enrollment group row and are redacted by the page. The administrator creates the role and token; the token itself does not need administrator privileges.

Reference: the tested Assignment full read role (21 selected permissions)

The supplied Central role-editor snapshot shows the following selections, with no write, manage, delete, execute or full-control selections checked. The associated token successfully read all eight inventory endpoints. This is a reference configuration, not a requirement to grant every extra permission.

Selections observed in the supplied role-editor snapshot
Permission categorySelected optionThe check needs it
Device templatesViewYes
Device instancesViewYes
Device groupsViewYes
Device connectivity managementRead instanceNo
Edge deployment manifestsRead instanceNo
JobsViewYes
RulesViewNo
Application settingsViewNo
Application template exportView export URLNo
Device file uploadViewNo
Custom rolesViewYes
User managementViewNo
Organization managementViewYes
Application dashboardsViewNo; keep it if Central adds it as a dependency
Personal dashboardsViewNo
Data explorerViewNo
Branding, favicon, and colorsViewNo
Help linksViewNo
Application textViewNo
Data exportViewYes
API tokensViewNo

For least privilege, use the checklist above, leave out the optional rows you do not need and keep required dependencies. The broader reference role also grants visibility into connectivity information, users and API-token metadata that the check does not request. Granting those permissions does not add anything to the check.

Billing and Audit Logs had no permissions selected in the supplied snapshot. Checked options that appear disabled are selected dependencies, not missing access; do not uncheck dependencies Central requires.

Role identity and endpoint access were verified through the API; the 21 selected options above were verified from the supplied role-editor HTML. Central's public roles API exposes names and IDs only, not permission definitions. Verify the saved role in Permissions > Roles. Microsoft permission reference.

Use the application address ending in .azureiotcentral.com, not an Azure resource name.
Paste the full SharedAccessSignature token. It stays in memory, goes only to this Central application, and is cleared when the run starts. It is never saved or sent to Helin.

GET requests only. Use a token with the minimum read permissions needed. Results reflect the token's organization scope, not necessarily the entire application. The check never reads device credentials, runs commands, provisions resources or moves devices.

Ready to connect. Nothing is sent until you run the check.