Go-live checklist

A test setup and a production setup differ in the details: a test device that still uses plain MQTT, an alarm nobody receives, an API key with every right. Go through this list before you put real devices into service, and again when you add a new kind of device. Each item links to the page that explains it.

Device connections

Check	Why	Read
Every profile keeps Plain MQTT on TLS only (port 8883), except a profile made for devices that cannot do TLS.	Credentials and data never cross the network in clear.	Device profiles
A profile that allows plain MQTT pins its Allowed networks (up to 64 networks or addresses).	A credential seen in clear then works only from your sites.	Device transport security
Commands allowed without TLS lists only harmless commands, or nothing.	Anyone on the path can read and inject a command sent in clear.	Sending commands to devices
Token in the URL is off, unless a device truly cannot send headers.	A token in a URL can leak through proxy logs. Such a profile becomes HTTP-only.	Device HTTP API
Devices connect by host name, not IP address, and verify the server certificate.	TLS needs the name; skipping verification invites interception.	MQTT

Credentials

Check	Read
Each device has its own credential. No token is shared between devices or copied from a test device.	Device credentials
Tokens and passwords that were pasted into tickets, chats or scripts during testing are rotated.	Device credentials
MQTT basic passwords are generated (32 characters) or at least 16 characters and varied.	Device credentials
Provisioning keys you no longer need are revoked; the strategy of each profile is the one you mean. Only pre-provisioned devices is safer than Allow creating new devices for devices sold in volume.	Adding and claiming devices
Nothing waits unexpectedly in Awaiting approval.	Quarantine for self-registered devices
Licensed devices are claimed into the right organisation; test units are released.	Licensed devices

Limits and quotas

Check	Read
Your plan’s device limit leaves room for growth. Quarantined devices, LoRaWAN gateways and gateway children count too.	Plans and the IoT add-on
The expected messages per month fit the plan. Telemetry and attribute messages count; commands, alarms and connection events do not. Warnings come at 80 % and 95 % by default, plus a notice when it is used up and when it is exceeded.	Message quota and usage
Profile rate limits fit the real reporting rate, with margin. Over-limit messages are dropped.	Device profiles
Devices batch readings instead of sending one message per value when they report often.	MQTT topics and payload reference

Online status and alarms

Check	Read
Each profile’s online rule fits its devices: Live connection for devices that hold MQTT, Recent message with a realistic Expected interval for devices that report and disconnect.	Connection status and activity
Every profile that matters has a Device offline rule.	Offline alarms
Every alarm rule that should wake someone has recipients (at most 20), a minimum severity and, if needed, a reminder. Rules without notify only record alarms.	Alarm notifications in depth
Each alarm was tested once with real or simulated values, and the recipients actually received it (e-mail, SMS or push as configured).	Set up your first alarm
The alarm settings fit your team: storm threshold, repeat window, Critical alarms ignore notification preferences, how long resolved alarms are kept (365 days by default).	Alarms
Devices placed under maintenance are muted, not left raising alarms.	Muting a device for maintenance

Data

Check	Read
Readings arrive and are stored: open a few devices’ Telemetry tabs. A device that is online but stores nothing usually means the root flow is off.	Hosts, the root flow and profile root flows
You know your retention class. Raw readings are kept at most 90 days; hourly and daily aggregates for the whole class (up to 1,095 days). Export what you must keep longer.	How long data is kept
Devices without a synchronised clock send without time stamps. Readings more than 10 minutes in the future are dropped.	Timestamps, late and duplicate readings
Values you want to chart are numbers. Text values show only as the latest value.	Numbers, text and true/false values
Profiles declare their telemetry keys with labels, units, decimals and ranges, so boards and gauges read well.	Telemetry keys
Devices are placed on sites and assets, and sites have a location and time zone (sunrise and sunset rules need them).	Placing devices

People and access

Check	Read
At least two people hold Admin or higher.	Users and roles
Every member has the smallest role that fits; field staff use IoT operator, read-only staff IoT viewer.	Groups and permissions
Two-factor sign-in is on for every administrator and owner.	Two-factor sign-in and passkeys
Members who left are removed; pending invitations you no longer want are revoked.	Invite your team
Command tiers fit: everyday commands Basic, disruptive ones Privileged or Critical and High impact with a typed confirmation.	Sending commands to devices

Integrations and audit

Check	Read
API keys have only the scopes they need (use the read-only preset for dashboards and reports), an expiry, and allowed networks. Test keys are revoked.	API key hardening
Webhooks point to HTTPS endpoints and your receiver checks the signature.	Webhooks
You know where to find the audit log and how to export it.	Audit log
Wall-screen display links have an expiry you accept, and old ones are revoked.	Wall screens, full screen and zoom

Firmware

Check	Read
Your release signing public keys are registered (owners only), and Allow unsigned images is off on production profiles.	Firmware updates (OTA)
Large fleets update in waves with gates, not all at once.	Rolling out firmware in waves
Devices on mobile links only update over them if you accept the cost.	Firmware updates (OTA)

On the day

1. Check the Devices list with the filters Connection: Offline and Status: Quarantined.
2. Open the Alarms page and resolve test alarms.
3. Check the usage page for your message count.
4. Tell your team where to look: the bell, the alarms page and the shared dashboards.

See Limits and quotas for every limit in one table.