diff --git a/recipes-azure-iot/azure-identityd/aziot-identityd.inc b/recipes-azure-iot/azure-identityd/aziot-identityd.inc
index 0a62ef91c..93869f476 100644
--- a/recipes-azure-iot/azure-identityd/aziot-identityd.inc
+++ b/recipes-azure-iot/azure-identityd/aziot-identityd.inc
@@ -17,6 +17,7 @@ SRC_URI += " \
 # workspace
 SRC_URI += " \
     file://aziot-identityd-precondition.service \
+    file://aziot-identityd-precondition.timer \
     file://iot-identity-service.conf \
     file://iot-identity-service-certd.template.toml \
 "
@@ -189,6 +190,7 @@ do_install() {
     else
         sed -i "s/@@AZIOTCLI@@/aziotctl/" ${D}${systemd_system_unitdir}/aziot-identityd-precondition.service
     fi
+    install -m 0644 ${WORKDIR}/aziot-identityd-precondition.timer ${D}${systemd_system_unitdir}/aziot-identityd-precondition.timer
 }
 
 pkg_postinst:${PN}() {
@@ -209,6 +211,7 @@ SYSTEMD_SERVICE:${PN} = " \
     aziot-identityd.service \
     aziot-identityd.socket \
     aziot-identityd-precondition.service \
+    aziot-identityd-precondition.timer \
     aziot-keyd.service \
     aziot-keyd.socket \
 "
diff --git a/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service b/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service
index 959cb432d..71f33e96a 100644
--- a/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service
+++ b/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service
@@ -16,6 +16,13 @@ ConditionPathExists=|/run/omnect-device-service/omnect_bootloader_updated
 
 ConditionFileNotEmpty=|!/etc/aziot/identityd/config.d/00-super.toml
 
+# with RestartSec=5 the default limit (5 starts per 10s) is never reached, so
+# the unit would loop in auto-restart forever instead of failing; the window
+# has to hold the whole burst, i.e. StartLimitBurst * (RestartSec + runtime of
+# one 'config apply')
+StartLimitBurst=5
+StartLimitIntervalSec=120
+
 [Service]
 Type=oneshot
 ExecStart=@@AZIOTCLI@@ config apply
diff --git a/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.timer b/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.timer
new file mode 100644
index 000000000..7f0ce9db2
--- /dev/null
+++ b/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.timer
@@ -0,0 +1,9 @@
+[Unit]
+Description=Retry Azure IoT Identity Service Precondition
+
+[Timer]
+# must exceed the unit's start-limit window, else the retry is rejected as well
+OnUnitInactiveSec=10min
+
+[Install]
+WantedBy=timers.target