Connect OPC UA to Azure IoT Edge / OPC Publisher
| Product | Azure IoT Edge / OPC Publisher |
|---|---|
| Category | Cloud |
| OPC UA role | Client |
OPC Publisher is an OPC UA client that runs as an IoT Edge module, subscribes to nodes you list in a configuration file, and forwards them to Azure IoT Hub as JSON. It is the best-documented OPC UA to cloud path, and its hardest problem is certificates rather than code.
Before you start
- An IoT Edge runtime on a gateway that can reach both the OPC UA servers and the cloud.
- A published-nodes configuration file listing the endpoints and node ids to subscribe to.
- A plan for how the publisher's certificate will be trusted on every server it talks to. This is the part that delays deployments, not the container.
- Outbound network from the gateway. The OPC UA side is inbound-only from the publisher's perspective, which is why it fits a layered network.
Setting it up
- Write the published-nodes fileOne entry per endpoint, each with a list of node ids, their publishing and sampling intervals and optional deadband. Store the namespace URI in the node id where the syntax allows rather than a raw index, so a PLC download does not silently break collection.
- Deploy the moduleDeploy as an IoT Edge module with the configuration file and a persistent volume for its PKI directory. The volume is not optional - see the gotchas.
- Trust the publisher on every serverOn first connection the publisher's certificate lands in each server's rejected store. An administrator moves it to trusted, on each server. Budget real time for this across a fleet, or deploy a certificate management approach first.
- Choose the encoding deliberatelyThe publisher can emit reversible or non-reversible JSON. Non-reversible is smaller and easier to read but discards type information and cannot be round-tripped. Decide before downstream consumers are written against it.
- Verify what arrivesCheck messages in IoT Hub and confirm the status code and SourceTimestamp survived. In JSON encoding a Good status is 0 and is omitted entirely, so an absent status field means Good rather than missing - downstream code must be written knowing that.
- Tune before scalingSet publishing intervals to what the cloud consumer needs rather than the fastest the PLC will give, apply deadbands on analogues, and keep the number of distinct intervals small. Each distinct interval becomes another subscription on the server.
What the address space looks like
The publisher does not model anything - it forwards the nodes you list. Semantics stay wherever you put them, which in practice means either the node ids carry meaning by convention or something downstream re-attaches it. If the machine implements a companion specification, that structure is lost unless you encode it in your topic or tag naming.
The traps
- A non-persistent PKI volume regenerates the application certificate on every container restart, so every server's trust list goes stale on every deploy. This is the single most common OPC Publisher deployment failure.
- The documentation states plainly that getting equipment to accept the publisher's certificate is the biggest hurdle most OT administrators face. Treat it as a project task with an owner, not a configuration detail.
- Non-reversible JSON silently loses type information. A downstream consumer cannot tell an Int32 from a Double, which matters the moment anyone does arithmetic.
- Reverse connect is supported for opc.tcp only, and the publisher listens on a configurable port for it. Useful through a Purdue-layered network where only outbound is permitted.
- Hardcoded namespace indexes in a published-nodes file break after a PLC program download. Use namespace URIs where the node id syntax supports it.
Getting OEE data out of it
Availability, counts and reasons all get to the cloud if the machine exposes them, but the publisher forwards values rather than interpreting them. State machine transitions arrive as value changes, so duration calculation happens downstream and depends on your publishing interval - a 10-second interval cannot resolve a 3-second micro-stop. Subscribe to Part 9 condition events for downtime reasons rather than polling a reason register. Planned production time and order context are not in the machine and will not appear here.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.