Microsoft Azure Sphere is a security platform built from three parts: the MT3620 crossover microcontroller, a custom Linux-based operating system, and Microsoft’s cloud Security Service. Its hardware foundation is Pluton, a silicon root of trust, while separate Cortex-A and Cortex-M subsystems handle high-level software and real-time I/O. The design is technically distinctive, but it is now a legacy platform: Microsoft announced retirement in March 2026, and support for its OS and Security Service is scheduled to end on July 31, 2031.
What Azure Sphere hardware is designed to do
Azure Sphere is not simply a secure chip. Microsoft designed it as a chain of hardware, software, and cloud controls intended to establish device identity, verify software during startup, limit what applications can access, and keep devices updated and authenticated over their service life.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
New Raspberry Pi 3 Model B+ Board (3B+) Raspberry PI 3B+ (1GB) (3B Plus) | $52.59 | Buy on Amazon |
| 2 |
|
CanaKit Raspberry Pi 4 4GB Starter PRO Kit - 4GB RAM | $159.99 | Buy on Amazon |
| 3 |
|
Raspberry Pi 4 Model B (2GB) | $83.00 | Buy on Amazon |
| 4 |
|
Raspberry Pi 5 8GB | $199.98 | Buy on Amazon |
| 5 |
|
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM) | $259.95 | Buy on Amazon |
The MT3620 brings the processing cores, memory, connectivity, peripherals, and Pluton security subsystem together in a crossover microcontroller. The OS and application model build on that hardware, while Azure Sphere’s Security Service supplies cloud functions such as remote attestation, device authentication, and updates.
Inside the MT3620: separate processing and trust domains
Microsoft describes the MT3620 as multiple cores and subsystems on one die, arranged in distinct trust domains. That separation allows the device to run a high-level application and real-time I/O workloads without treating every component as equally trusted or equally connected.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Subsystem | Hardware and role | Access and boundary |
|---|---|---|
| Pluton security subsystem | Security processor core, cryptographic engines, hardware random-number generator, and support for key generation and cryptographic operations. | Provides the hardware root of trust and supports secure boot, measured boot, remote attestation, and tamper countermeasures. |
| High-level application subsystem | ARM Cortex-A core runs the OS, high-level applications, and services. | Applications run in a constrained environment rather than receiving unrestricted OS access. |
| Real-time I/O subsystem | ARM Cortex-M cores run real-time-capable applications. | Can communicate with high-level applications, but cannot access the internet directly. |
Hardware firewalls and resource isolation separate components and limit how far a compromised part can affect others. The arrangement is intended to make the security boundary a property of the platform, not just an application-level promise.
Memory, connectivity, and peripherals
Microsoft’s 2023 architecture specifications list minimum integrated memory of 4 MB RAM and 16 MB flash. These are vendor specifications, not independent benchmark measurements. The MT3620’s radio supports dual-band 802.11 b/g/n Wi-Fi; devices equipped appropriately may also use Ethernet. Microsoft lists UART, SPI, I2C, and GPIO among the supported peripherals.
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
Pluton is the foundation, not the entire security system
Microsoft calls Pluton “the hardware-based (in silicon) secured root of trust for Azure Sphere.” The subsystem protects device identity and supports secure boot, which verifies signed software at startup, and measured boot, which records measurements that can be used for remote attestation.
Above Pluton, Microsoft’s Security Monitor and custom Linux-based OS provide additional controls. The high-level application runs in a constrained container with limited OS services and Microsoft-provided libraries. Azure Sphere’s cloud Security Service adds remote attestation, passwordless device authentication, OS and application updates, and crash and error reporting. Pluton supplies a hardware base; it does not by itself provide all these platform and service functions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Broadcom BCM2711, Quad core Cortex-A72 (ARM v8) 64-bit SoC @ 1.5GHz
- 1GB, 2GB, 4GB or 8GB LPDDR4-3200 SDRAM (depending on model)
- 2.4 GHz and 5.0 GHz IEEE 802.11ac wireless, Bluetooth 5.0, BLE Gigabit Ethernet
- 2 USB 3.0 ports; 2 USB 2.0 ports.
- Raspberry Pi standard 40 pin GPIO header (fully backwards compatible with previous boards)
Normal World and Secure World
The application platform divides execution between Normal World and Secure World. Applications run in Normal World user mode, the custom Linux kernel runs in Normal World supervisor mode, and Microsoft’s Security Monitor runs in Secure World. Only Microsoft-supplied code runs in supervisor mode or Secure World.
Applications do not get unrestricted POSIX or shell access, and deployed image packages must be signed. These restrictions are deliberate security boundaries, but they also make Azure Sphere different from a conventional Linux board: developers cannot assume they can install arbitrary packages, use a shell, or change low-level system software as they might on a general-purpose Linux device.
Rank #4
- Raspberry Pi 5 with 8GB RAM: Model SC1112 featuring a quad-core ARM Cortex-A76 processor running at 2.4GHz. Enhanced Connectivity: Includes dual 4K micro HDMI ports, USB-C power input, and high-speed USB 3.0 ports. PCIe Expansion Support: FPC connector enables M.2 NVMe SSDs when using compatible adapters. Fast Storage Options: Works with microSD cards for booting, or optional NVMe storage for advanced projects. Built for Projects & Learning: Ideal for programming, home labs, DIY electronics, automation, and Linux-based development.
Developer boards and their practical limits
Microsoft’s developer quickstarts name three boards: the Seeed Azure Sphere MT3620 Development Kit, the Avnet Azure Sphere MT3620 Starter Kit, and the Seeed MT3620 Mini Dev Board. The quickstarts describe an Azure account and subscription, a resource group, a developer kit, a supported Windows or Ubuntu machine, SDK setup, device claiming, and network configuration as development prerequisites.
| Board or family | What the available product information says | Practical qualification |
|---|---|---|
| Seeed Azure Sphere MT3620 Development Kit | Seeed describes it as a rapid-prototyping board. | Seeed states it can only be used for prototyping and cannot be built into a commercially distributed product or used in production. Its listing showed stock on October 4, 2026; that is a dated listing observation, not a guarantee of ongoing availability. |
| Avnet Azure Sphere MT3620 Starter Kit and MT3620 modules | Avnet describes the Starter Kit V2 carrier board and MT3620 module, including Wi-Fi, Cortex-A and Cortex-M cores, expansion interfaces, and sensors. | Avnet says the MT3620 Starter Kit and MT3620 modules are no longer available. Check current inventory and terms rather than treating them as ordinary current-production choices. |
| Seeed MT3620 Mini Dev Board | Named by Microsoft’s developer quickstarts. | The cited quickstart names the board; no separate availability or production-use terms are established here. |
A development board is useful for evaluating software and peripherals, but it does not establish that a commercial product can use the same board or that replacement MT3620 hardware will be available for a product’s full service life.
Best Value
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Retirement timeline and the effect on deployed devices
Microsoft’s announcement sets a defined end to the platform’s support runway. The dates have different meanings: the chip’s end of life is not the same event as the end of cloud and OS support.
| Date | Milestone | Meaning |
|---|---|---|
| March 20, 2026 | Microsoft announced planned Azure Sphere retirement. | Customers were advised to begin planning for replacement hardware and migration. |
| July 31, 2026 | MT3620 MCU reached end of life. | The MCU is at end of life; this is separate from the later end date for Azure Sphere OS and Security Service extended support. |
| July 31, 2031 | Scheduled end of extended support for Azure Sphere OS and Security Service. | Devices stop receiving application and OS updates, bug fixes, and security patches. Device attestation and authentication services also cease. |
Microsoft says MT3620-based hardware will require redesign for continued functionality beyond retirement. A device that still powers on after service support ends should not be confused with a device that continues to receive security maintenance or can use Azure Sphere’s attestation and authentication services.
Planning a successor without assuming a drop-in replacement
Microsoft recommends evaluating replacement hardware and identifies silicon with PSA/SESIP Level 3+ or similar certification as a guideline for seeking similar security properties. That is guidance, not a mandatory replacement part number or a guarantee that another MCU will reproduce Azure Sphere’s integrated security model.
Assess a candidate against the whole product, not just its core count or advertised security features:
- Lifecycle and availability: Confirm that the silicon, modules, and development tools can be sourced for the intended product life, and review the supplier’s support commitments.
- Root of trust and attestation: Determine how the successor establishes device identity, verifies boot software, protects keys, and proves device state to services. Review relevant certifications and the actual attestation capabilities.
- Compute and I/O fit: Map the Cortex-A and Cortex-M workloads, timing requirements, memory needs, and required interfaces such as UART, SPI, I2C, and GPIO to the proposed design.
- Connectivity: Check Wi-Fi, Ethernet, and other network requirements against the target hardware and deployment environment.
- Software migration: Plan for changes to operating system, application APIs, signing and update processes, cloud identity, and development toolchain. Azure Sphere’s constrained Linux environment is not interchangeable with an unrestricted Linux workflow.
- Product-use terms: Verify whether the evaluation board, module, or license permits prototyping only or production deployment.
Microsoft points customers to Azure IoT Hub, Azure Device Registry and X.509 certificate management, Device Update for Azure IoT Hub, and Azure IoT libraries as possible components of a replacement solution. These services and libraries may help with parts of device management or connectivity, but they do not by themselves recreate Azure Sphere as an integrated hardware, OS, and Security Service platform.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
