If you are using EZCA for Azure IoT and would like to EZCA to automatically add new CA certificates to Azure IoT, EZCA must to have Contributor Role access to your IoT Hubs. Note: If you are going to manually rotate your CAs in Azure IoT, this step is not required.