Device Update compatibility matching fails - bestCompatibleUpdate remains null despite exact property match

[XploitXploit]

Expected Behavior
The imported update should be compatible with my device and allow creation of new deployments.

Current Behavior
My imported update is not being matched with my device for compatibility. The deployment creation fails with error:
{'error': {'code': 'DeploymentCannotBeCreated', 'message': 'Deployment cannot be created because the update is not compatible with any devices in the group'}}
Device class shows bestCompatibleUpdate: null despite exact property matching.

Steps to Reproduce

1. Import update manifest (v5.0) with compatibility: manufacturer: "cdm3b", model: "pos-terminal"
2. Import associated script file (installpackage.sh)
3. Set ADUGroup tag on IoTHubDeviceUpdate module twin: {"ADUGroup":"pos-terminals"}
4. Device appears in Device Update with correct properties but shows bestCompatibleUpdate: null
5. Attempt to create deployment fails with compatibility error

Note: This setup worked once initially, but after deleting and reimporting the same update with identical compatibility properties, the matching fails consistently.

Device Information

Host OS: Ubuntu 24.04.3 LTS
Architecture: amd64
Provisioning Method: Azure Identity Service (AIS)
DU Agent Version: 1.2.0

Device Configuration

{
  "schemaVersion": "1.1",
  "aduShellTrustedUsers": ["adu", "do"],
  "iotHubProtocol": "mqtt",
  "compatPropertyNames": "manufacturer,model",
  "manufacturer": "cdm3b",
  "model": "pos-terminal",
  "agents": [
    {
      "name": "main",
      "runas": "adu",
      "connectionSource": {
        "connectionType": "AIS",
        "connectionData": ""
      },
      "manufacturer": "cdm3b",
      "model": "pos-terminal"
    }
  ]
}
Update Manifest Compatibility
json{
  "compatibility": [
    {
      "manufacturer": "cdm3b",
      "model": "pos-terminal"
    }
  ],
  "manifestVersion": "5.0",
  "updateId": {
    "name": "hello-test",
    "provider": "cdm3b",
    "version": "1.0.2"
  },
  "instructions": {
    "steps": [
      {
        "handler": "microsoft/script:1",
        "handlerProperties": {
          "installedCriteria": "1.0.2",
          "scriptFileName": "installpackage.sh"
        }
      }
    ]
  }
}

Device Class Information

Device Class ID: 4222a4aa25458d64c6d9d701bec1b703a2b74791
Reported Properties: manufacturer: "cdm3b", model: "pos-terminal"
Contract Model: dtmi:azure:iot:deviceUpdateContractModel;3
bestCompatibleUpdate: null ← This is the problem

Troubleshooting Performed

Device Update agent health check: PASSED
All Azure permissions correctly configured (Storage Blob Data Contributor, IoT Hub Data Contributor)
Device import/refresh operations attempted multiple times
Verified exact property matching between device and manifest
Agent logs show successful connection and property reporting with no errors
Update shows isDeployable: true and scanResult: "OptedOut"

Logs
Device Update agent is healthy and reporting correct properties:

2025-09-22T07:44:10.6108Z 4751[4751] [I] Health check passed. [HealthCheck:632] 2025-09-22T07:44:10.6108Z 4751[4751] [I] Agent exited with code 0 [main:1104] 2025-09-22T07:44:10.6109Z 4751[4751] [W] Agent is shutting down. [ShutdownAgent:815] 2025-09-22T07:44:10.6109Z 4751[4751] [I] De-initializing command listener thread [UninitializeCommandListenerThread:409] 2025-09-22T07:44:10.6109Z 4751[4751] [I] ADUC agent stopping [AzureDeviceUpdateCoreInterface_Destroy:313] 2025-09-22T07:44:10.6109Z 4751[4751] [I] Uninitializing config info. [ADUC_ConfigInfo_UnInit:525]

device-update-logs.txt

Module twin correctly reports device properties:

"deviceProperties": {
  "manufacturer": "cdm3b",
  "model": "pos-terminal",
  "aduVer": "Gen1DU;agent/1.2.0",
  "contractModelId": "dtmi:azure:iot:deviceUpdateContractModel;3"
}

Backend compatibility matching failure:

az iot du device class show --class-id "4222a4aa25458d64c6d9d701bec1b703a2b74791"

{
  "bestCompatibleUpdate": null,  // Should show the compatible update
  "deviceClassProperties": {
    "compatProperties": {
      "manufacturer": "cdm3b",    // Matches manifest exactly
      "model": "pos-terminal"     // Matches manifest exactly
    }
  }
}

Additional Information

This appears to be a backend compatibility matching engine issue rather than device configuration
All technical components are functioning correctly and properties match exactly
Same setup worked once before but fails consistently after reimport
Issue persists across service restarts, device reboots, and device import refreshes
The compatibility properties are identical between device class and update manifest

device-update-logs.txt

[XploitXploit]

device-class.json
device-groups.json
device-list.json
module-twin.json
update-details.json

[XploitXploit]

Root Cause Identified: Multi-Property Compatibility Bug

Working Configuration:

• Device: compatPropertyNames: "manufacturer"
• Update: "compatibility": [{"manufacturer": "cdm3b"}]
• Result: bestCompatibleUpdate shows the update correctly

Broken Configuration:

• Device: compatPropertyNames: "manufacturer,model"
• Update: "compatibility": [{"manufacturer": "cdm3b", "model": "pos-terminal"}]
• Result: bestCompatibleUpdate: null despite exact property match

This proves the issue is a backend bug in Azure Device Update's multi-property compatibility matching engine, not device configuration.

[devlie]

@XploitXploit thank you for the report. You have indeed exposed a backend bug, but it's not due to multi-property compatibility.

What seems to have happened is that at one point there was a deviceClass that had 0 or >5 compat properties, and that invalid deviceClass exposed a bug on our end that prevented it from completing the compability check.

You deleted about 5 deviceClasses around 9/22/25 9:36 PDT, then imported the single property deviceClass 39f5df7dd9626f851532997603cfa3ccd85c6a25 and its corresponding update. That compatibility check completed fine because the invalid deviceClass was already deleted.

If you now try importing a newer version of the update that's compatible with deviceClass 4222a4aa25458d64c6d9d701bec1b703a2b74791, we think it should work.

Hope this helps. Thanks again.

P.S. Do you happen to have a twin record of the device with invalid compat properties?

[XploitXploit]

Hi @devlie, thanks for the response!! Sadly i dont have the module twin device data, this is a testing enviroment and i delete the device. Im going to try to import the new one to see if it works now.