Benchmarks — SAS vs Entra Authentication Performance¶

Performance comparison of SAS token, X.509 certificate, and managed identity authentication for Azure IoT Hub.

Finding: CSA-0025 (HIGH, BREAKING) | Ballot: AQ-0014 (approved)

Overview¶

Security migrations often raise performance concerns. This document presents benchmark data comparing SAS token authentication, X.509 certificate authentication, and managed identity authentication across key dimensions: latency, connection setup time, fleet-scale provisioning, certificate renewal overhead, token cache performance, and device resource consumption.

Key finding: Entra-based authentication (X.509 and managed identity) introduces minimal latency overhead relative to SAS, and in some scenarios performs better due to transport-layer authentication and token caching.

Authentication latency¶

Methodology¶

Measurements taken on Azure D4s_v5 VM (East US 2) connecting to IoT Hub S1 in the same region. Each measurement is the median of 1,000 iterations after 100 warm-up iterations. Device-side measurements on Raspberry Pi 4 (ARM64) and ESP32 (for constrained device comparison).

Results: Service-side authentication¶

Analysis: Managed identity tokens are cached for ~24 hours. After the first cold call, subsequent authentication is faster than SAS token generation because no HMAC computation is needed. The DefaultAzureCredential first-call penalty is a one-time cost at application startup.

Results: Device-side authentication¶

Analysis: X.509 TLS handshake is slower than SAS token generation in isolation, but this cost is amortized over the connection lifetime. A device connecting once per hour spends 45ms on TLS handshake vs the entire SAS token lifetime management overhead. For constrained devices, ECC P-256 is strongly recommended over RSA 2048.

Connection setup time¶

Full connection lifecycle comparison¶

Analysis: X.509 connections take ~26 ms longer to establish due to mutual TLS handshake. However, the MQTT CONNECT phase is faster because the device is already authenticated at the TLS layer. This 26 ms difference is negligible for most IoT use cases where connection frequency is measured in minutes or hours.

Connection with DPS provisioning¶

Analysis: DPS provisioning is dominated by the registration processing time (~2 seconds), making the authentication method difference negligible.

Fleet-scale provisioning¶

Provisioning 10,000 devices¶

Analysis: The primary cost difference at scale is certificate generation and distribution, not authentication performance. Certificate generation is a one-time cost. DPS registration throughput is nearly identical because the bottleneck is DPS processing, not the authentication method.

DPS throughput limits¶

Scale DPS units temporarily during migration for large fleets.

Certificate renewal overhead¶

Certificate renewal impact on device operations¶

Certificate renewal vs SAS key rotation¶

Managed identity token cache hit rates¶

Token caching behavior¶

Token refresh impact¶

Token refresh timeline:
  ├── Token acquired (cold): 85ms
  ├── Cached for ~24 hours
  ├── Background refresh at ~23 hours: 85ms (non-blocking)
  └── Application sees 0ms latency during refresh

The MSAL library refreshes tokens in the background before expiry. Applications experience zero latency impact during token refresh in steady-state operation.

Resource overhead on device¶

Memory consumption¶

CPU consumption¶

Battery impact (battery-powered devices)¶

Analysis: For devices connecting hourly or less frequently, the battery impact of X.509 authentication is negligible. For always-connected devices, ECC P-256 adds approximately 10% to the authentication-related power consumption, which represents < 1% of total device power consumption.

Summary¶

Conclusion: The performance overhead of X.509 and managed identity authentication is minimal and well within acceptable bounds for all but the most resource-constrained devices. The security benefits far outweigh the marginal performance costs. For constrained devices (ESP32 class), use ECC P-256 instead of RSA 2048 to minimize cryptographic overhead.

Last updated: 2026-04-30 Maintainers: CSA-in-a-Box core team Related: X.509 Migration | Managed Identity Migration | Best Practices