Governance Policies Azure Messaging Notification Hubs

Notification Hubs

Governance policies for Notification Hubs

Domain: azure-messaging

Patterns

Name	Description
Notification Hubs with private endpoint and zone redundancy	Standard tier namespace with zone redundancy, private endpoints, and Key Vault-backed PNS credentials

Anti-Patterns

Description	Instead
Do not embed PNS credentials in IaC templates	Store APNS certificates, FCM keys, and WNS secrets in Key Vault
Do not distribute full access SAS keys to clients	Use listen-only or registration-scoped SAS policies for client applications

References

• Azure Notification Hubs documentation
• Notification Hubs security

---

Checks (4)

Check	Severity	Description
AZ-NH-001	Required	Deploy Notification Hubs namespace with Standard SKU, managed identity, and no public access
AZ-NH-002	Required	Store PNS credentials (APNS certificates, FCM keys) in Key Vault and reference from hub configuration
AZ-NH-003	Recommended	Use installation-based registration for device management
AZ-NH-004	Recommended	Enable zone redundancy for high availability

---

AZ-NH-001

Deploy Notification Hubs namespace with Standard SKU, managed identity, and no public access

Severity: Required
Rationale: Standard SKU provides SLA, telemetry, and scheduled push; managed identity eliminates SAS key management
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.NotificationHubs/namespaces

Companion Resources

Resource	Name	Purpose
Microsoft.NotificationHubs/namespaces/notificationHubs	notification-hub	Notification Hub within the namespace for platform notification service (PNS) integration
Microsoft.Network/privateEndpoints	pe-nh	Private endpoint for Notification Hubs namespace
Microsoft.Network/privateDnsZones	privatelink.servicebus.windows.net	Private DNS zone for Notification Hubs private endpoint resolution
Microsoft.Insights/diagnosticSettings	diag-nh	Diagnostic settings for push notification delivery logs

---

AZ-NH-002

Store PNS credentials (APNS certificates, FCM keys) in Key Vault and reference from hub configuration

Severity: Required
Rationale: PNS credentials are sensitive and must be rotated; Key Vault provides audited access and rotation
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.NotificationHubs/namespaces

---

AZ-NH-003

Use installation-based registration for device management

Severity: Recommended
Rationale: Installations provide a newer API, support multiple PNS handles per device, and enable partial updates
Agents: cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.NotificationHubs/namespaces

---

AZ-NH-004

Enable zone redundancy for high availability

Severity: Recommended
Rationale: Zone redundancy ensures notification delivery during availability zone failures
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.NotificationHubs/namespaces

---