Free penetration test
Free cloud & web-app pentest for qualified companies. SOC 2, HIPAA, PCI DSS-aligned report.
ApplyIoT integration is the work of connecting sensors, machines and gateways to the cloud platforms and business systems that use their data. It covers four layers: device connectivity and protocols, an ingestion platform such as AWS IoT Core or Azure IoT Hub, data pipelines into ERP, MES or analytics tools, and security across all of them.
Key takeaways
- Integration is where most IoT projects stall: devices are easy to buy, but getting their data into ERP, MES and dashboards takes engineering.
- Plan four layers: devices and protocols (MQTT, OPC UA, Modbus), edge gateways, a cloud ingestion platform, and links to business applications.
- MQTT is the default protocol for cloud IoT; AWS IoT Core and Azure IoT Hub both accept it, so it keeps you portable.
- Security must be designed in per device: unique identity, signed updates and logging. The EU Cyber Resilience Act makes this a legal duty for connected products.
- Start with one use case and a defined data model, then scale. Integrating every device at once rarely pays off.
What does integrating IoT devices involve?
It involves making data flow reliably from physical devices into the software where decisions are made. In practice that means solving protocol, data and security problems at the same time.
A factory might run PLCs that speak Modbus or OPC UA, battery sensors that send small LoRaWAN packets, and newer machines with built-in MQTT clients. None of them talk to SAP, a maintenance system or a Power BI report out of the box. The integration layer translates, buffers and secures that traffic so each consumer gets clean, timestamped data in a format it understands.
Typical integration tasks include:
- Device integration: onboarding devices with an identity, certificates and a known configuration.
- Protocol translation: converting fieldbus or proprietary protocols to MQTT or HTTPS at an edge gateway.
- Data integration: normalising units, timestamps and asset IDs, then routing data to storage, streams and APIs.
- Application integration: pushing events into ERP, MES, CMMS or ticketing tools, and sending commands back to devices.
- Cloud integration: connecting the IoT platform to data lakes, analytics and machine learning services.
The four layers of a connected IoT architecture
Most production architectures share the same four layers, whichever cloud you choose. The table shows what each layer does and the typical choices.
| Layer | What it does | Typical technology |
|---|---|---|
| Devices and sensors | Measure and act: temperature, vibration, energy, position, machine state | PLCs, smart meters, industrial sensors, cameras |
| Edge and gateways | Translate protocols, filter and buffer data, run local logic when the network is down | AWS IoT Greengrass, Azure IoT Edge, industrial gateways |
| Cloud ingestion platform | Authenticate devices, receive messages, route them, manage device state and updates | AWS IoT Core, Azure IoT Hub |
| Business applications | Turn data into decisions: alerts, work orders, reports, models | ERP, MES, CMMS, data warehouse, BI, ML |
On AWS, AWS IoT Core supports MQTT, MQTT over WebSockets, HTTPS and LoRaWAN for device traffic. On Azure, IoT Hub keeps an identity registry of every device allowed to connect and supports MQTT and AMQP. Edge runtimes such as AWS IoT Greengrass run logic close to the machines, which matters on sites with poor connectivity.
Which protocols matter for connecting IoT devices?
MQTT for device-to-cloud messaging and OPC UA for industrial equipment cover most cases. HTTPS, AMQP, Modbus and LoRaWAN fill specific gaps.
- MQTT: a lightweight publish/subscribe protocol standardised by OASIS (the current version is MQTT 5.0). It suits constrained devices and unreliable networks.
- OPC UA: the common information model for machines and PLCs in manufacturing. Gateways often read OPC UA and publish MQTT.
- Modbus and other fieldbuses: still common on older equipment. They need a gateway to reach the cloud.
- LoRaWAN and cellular (LTE-M, NB-IoT): for battery sensors spread across large sites. See our guide to IoT connectivity options.
Choosing an open protocol is the cheapest form of insurance against platform lock-in. If your devices speak standard MQTT, moving between cloud platforms is a configuration project, not a hardware replacement.
How do you secure an integrated IoT system?
Give every device its own identity, encrypt traffic, sign firmware updates and log what happens. Then separate IoT networks from office IT and plant control systems.
The NIST IR 8259A core baseline lists the device capabilities you should expect from suppliers: device identification, configuration control, data protection, logical access, software updates and cybersecurity state awareness. Use it as a checklist in procurement.
In the EU, the Cyber Resilience Act adds legal weight. According to the European Commission, the CRA's reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027. Manufacturers of connected products sold in the EU must handle vulnerabilities and security updates across the product's support period. If you integrate third-party devices, ask suppliers how they will meet these duties.
Industrial sites also need to keep IoT traffic away from control networks. Our article on OT vs IoT security explains where the risks differ.
A practical integration process, step by step
Successful projects follow a short, repeatable sequence rather than a big-bang rollout.
- Pick one use case with a clear owner and metric. For example, unplanned downtime on one production line, or energy use per building.
- Inventory devices and protocols. List what exists, what it speaks, and what must be added or replaced.
- Define the data model. Agree asset IDs, units, sampling rates and retention before any data flows.
- Choose the ingestion platform and edge pattern. Decide what runs on site and what runs in the cloud.
- Build the pipeline to one business system. Get the first alert or work order into the tool people already use.
- Add operations. Set up IoT monitoring, certificate rotation, firmware updates and on-call routines.
- Scale by copying the pattern to the next line, site or device type.
Step 6 is the one teams skip. A pilot that works for three months can fail quietly when certificates expire or a gateway disk fills up. Ongoing IoT device management is part of the integration, not an afterthought.
Common challenges and how to avoid them
- Mixed vendors and legacy equipment: budget for gateways and protocol work, and test with real machines early.
- Data without context: a temperature reading is useless without an asset ID and location. Fix the data model first.
- Too much data: filter and aggregate at the edge. Sending every raw sample to the cloud raises cost without adding insight.
- Unclear ownership: IT, OT and the business all touch the system. Name one owner for the platform and one per use case.
- Weak supplier security: default passwords and unsigned updates are still common. Make the NIST baseline a purchasing requirement.
How Opsio helps
Opsio designs and runs connected-device projects on AWS and Azure, from gateway patterns and device onboarding to data pipelines and analytics. Our IoT solution development team builds the integration, and our data analytics and BI services turn the data into dashboards and models your teams use. We work from offices in Karlstad, Sweden and Bangalore, India.
Frequently asked questions
What is IoT integration in simple terms?
It is connecting physical devices to the software that uses their data. Sensors and machines send readings through gateways to a cloud platform, which passes clean data to systems such as ERP, maintenance tools and dashboards.
What is the difference between IoT integration services and an IoT platform?
A platform, such as AWS IoT Core or Azure IoT Hub, provides the building blocks: device identity, messaging and routing. Integration services are the engineering work that connects your specific devices, protocols and business systems to that platform and keeps it running.
Which protocol should we use to connect IoT devices to the cloud?
Use MQTT where devices support it, because both major cloud IoT platforms accept it and it works well on weak networks. For industrial machines, read data over OPC UA or Modbus at an edge gateway and publish it to the cloud over MQTT.
How long does it take to integrate IoT devices?
It depends on device count, protocols and how many business systems you connect. A single, well-scoped use case on existing equipment is far faster than a multi-site rollout. Scope one use case first and use its timeline to plan the rest.
Does the EU Cyber Resilience Act affect connected-device projects?
Yes, if you build or sell connected products in the EU. Manufacturers must manage vulnerabilities and provide security updates. Reporting duties apply from September 2026 and most other duties from December 2027. Buyers should check supplier readiness during procurement.
Related reading: We Are Your Trusted Data Integration Consultant for Cloud Innovation.
Related reading: How Data Integration Consulting Services Streamline Business Operations.
Related Guides
Written By
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by the cloud practitioner named in the byline above. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.