diff --git a/iothub/device/src/AuthenticationWithTokenRefresh.cs b/iothub/device/src/AuthenticationWithTokenRefresh.cs
index c68267e2c8..517d414022 100644
--- a/iothub/device/src/AuthenticationWithTokenRefresh.cs
+++ b/iothub/device/src/AuthenticationWithTokenRefresh.cs
@@ -12,7 +12,7 @@ namespace Microsoft.Azure.Devices.Client
     /// <summary>
     /// Authentication method that uses a shared access signature token and allows for token refresh.
     /// </summary>
-    public abstract class AuthenticationWithTokenRefresh : IAuthenticationMethod, IDisposable
+    public abstract class AuthenticationWithTokenRefresh : IAuthenticationMethod
     {
         private readonly int _suggestedTimeToLiveSeconds;
         private readonly int _timeBufferPercentage;
diff --git a/iothub/device/src/ClientFactory.cs b/iothub/device/src/ClientFactory.cs
index 07a5733bd6..9790ed844b 100644
--- a/iothub/device/src/ClientFactory.cs
+++ b/iothub/device/src/ClientFactory.cs
@@ -88,7 +88,7 @@ public static InternalClient Create(string hostname, string gatewayHostname, IAu
                 throw new ArgumentException("Certificate chains are only supported on Amqp_Tcp_Only and Mqtt_Tcp_Only");
             }
 
-            IotHubConnectionStringBuilder connectionStringBuilder = IotHubConnectionStringBuilder.Create(hostname, gatewayHostname, authenticationMethod);
+            using IotHubConnectionStringBuilder connectionStringBuilder = IotHubConnectionStringBuilder.Create(hostname, gatewayHostname, authenticationMethod);
 
             // Make sure client options is initialized with the correct transport setting.
             EnsureOptionsIsSetup(connectionStringBuilder.Certificate, ref options);
@@ -100,7 +100,9 @@ public static InternalClient Create(string hostname, string gatewayHostname, IAu
                     throw new ArgumentException("No certificate was found. To use certificate authentication certificate must be present.");
                 }
 
+#pragma warning disable CA2000 // This is returned to client so cannot be disposed here.
                 InternalClient dc = CreateFromConnectionString(connectionStringBuilder.ToString(), PopulateCertificateInTransportSettings(connectionStringBuilder, transportType), options);
+#pragma warning restore CA2000
                 dc.Certificate = connectionStringBuilder.Certificate;
 
                 // Install all the intermediate certificates in the chain if specified.
@@ -158,7 +160,7 @@ public static InternalClient Create(string hostname, string gatewayHostname, IAu
                 throw new ArgumentNullException(nameof(authenticationMethod));
             }
 
-            var connectionStringBuilder = IotHubConnectionStringBuilder.Create(hostname, gatewayHostname, authenticationMethod);
+            using IotHubConnectionStringBuilder connectionStringBuilder = IotHubConnectionStringBuilder.Create(hostname, gatewayHostname, authenticationMethod);
 
             // Make sure client options is initialized with the correct transport setting.
             EnsureOptionsIsSetup(connectionStringBuilder.Certificate, ref options);
@@ -364,7 +366,7 @@ internal static InternalClient CreateFromConnectionString(
                 throw new ArgumentOutOfRangeException(nameof(connectionString), "Must specify at least one TransportSettings instance");
             }
 
-            var builder = IotHubConnectionStringBuilder.CreateWithIAuthenticationOverride(
+            using var builder = IotHubConnectionStringBuilder.CreateWithIAuthenticationOverride(
                 connectionString,
                 authenticationMethod);
 
diff --git a/iothub/device/src/DeviceAuthenticationWithRegistrySymmetricKey.cs b/iothub/device/src/DeviceAuthenticationWithRegistrySymmetricKey.cs
index c0713e544e..24fcc9c445 100644
--- a/iothub/device/src/DeviceAuthenticationWithRegistrySymmetricKey.cs
+++ b/iothub/device/src/DeviceAuthenticationWithRegistrySymmetricKey.cs
@@ -69,8 +69,8 @@ public IotHubConnectionStringBuilder Populate(IotHubConnectionStringBuilder iotH
                 throw new ArgumentNullException(nameof(iotHubConnectionStringBuilder));
             }
 
-            iotHubConnectionStringBuilder.DeviceId = this.DeviceId;
-            iotHubConnectionStringBuilder.SharedAccessKey = this.KeyAsBase64String;
+            iotHubConnectionStringBuilder.DeviceId = DeviceId;
+            iotHubConnectionStringBuilder.SharedAccessKey = KeyAsBase64String;
             iotHubConnectionStringBuilder.SharedAccessKeyName = null;
             iotHubConnectionStringBuilder.SharedAccessSignature = null;
 
@@ -106,5 +106,11 @@ private void SetDeviceId(string deviceId)
 
             _deviceId = deviceId;
         }
+
+        /// <inheritdoc />
+
+        public void Dispose()
+        {
+        }
     }
 }
diff --git a/iothub/device/src/DeviceAuthenticationWithSharedAccessPolicyKey.cs b/iothub/device/src/DeviceAuthenticationWithSharedAccessPolicyKey.cs
index b972935ca9..de1d7ce33b 100644
--- a/iothub/device/src/DeviceAuthenticationWithSharedAccessPolicyKey.cs
+++ b/iothub/device/src/DeviceAuthenticationWithSharedAccessPolicyKey.cs
@@ -55,6 +55,12 @@ public string PolicyName
             set => SetPolicyName(value);
         }
 
+        /// <inheritdoc />
+
+        public void Dispose()
+        {
+        }
+
         /// <summary>
         /// Populates an <see cref="IotHubConnectionStringBuilder"/> instance based on the properties of the current instance.
         /// </summary>
diff --git a/iothub/device/src/DeviceAuthenticationWithToken.cs b/iothub/device/src/DeviceAuthenticationWithToken.cs
index 957bbe38f8..f10d8ebb6a 100644
--- a/iothub/device/src/DeviceAuthenticationWithToken.cs
+++ b/iothub/device/src/DeviceAuthenticationWithToken.cs
@@ -43,6 +43,12 @@ public string Token
             set => SetToken(value);
         }
 
+        /// <inheritdoc />
+
+        public void Dispose()
+        {
+        }
+
         /// <summary>
         /// Populates an <see cref="IotHubConnectionStringBuilder"/> instance based on the properties of the current instance.
         /// </summary>
diff --git a/iothub/device/src/DeviceAuthenticationWithX509Certificate.cs b/iothub/device/src/DeviceAuthenticationWithX509Certificate.cs
index 0a60b7fc46..71d82a8d35 100644
--- a/iothub/device/src/DeviceAuthenticationWithX509Certificate.cs
+++ b/iothub/device/src/DeviceAuthenticationWithX509Certificate.cs
@@ -48,6 +48,16 @@ public string DeviceId
         /// </summary>
         public X509Certificate2Collection ChainCertificates { get; }
 
+        /// <inheritdoc />
+
+        public void Dispose()
+        {
+#if !NET451
+            Certificate?.Dispose();
+            Certificate = null;
+#endif
+        }
+
         /// <summary>
         /// Populates an <see cref="IotHubConnectionStringBuilder"/> instance based on the properties of the current instance.
         /// </summary>
diff --git a/iothub/device/src/IAuthenticationMethod.cs b/iothub/device/src/IAuthenticationMethod.cs
index 4661180e81..4c37efe1e3 100644
--- a/iothub/device/src/IAuthenticationMethod.cs
+++ b/iothub/device/src/IAuthenticationMethod.cs
@@ -1,12 +1,14 @@
 // Copyright (c) Microsoft. All rights reserved.
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
+using System;
+
 namespace Microsoft.Azure.Devices.Client
 {
     /// <summary>
     /// Authentication interface to use for device communications.
     /// </summary>
-    public interface IAuthenticationMethod
+    public interface IAuthenticationMethod : IDisposable
     {
         /// <summary>
         /// Populates an <see cref="IotHubConnectionStringBuilder"/> instance based on the properties of the current instance.
diff --git a/iothub/device/src/IotHubConnectionStringBuilder.cs b/iothub/device/src/IotHubConnectionStringBuilder.cs
index 09c62c5a00..2c797c6cf7 100644
--- a/iothub/device/src/IotHubConnectionStringBuilder.cs
+++ b/iothub/device/src/IotHubConnectionStringBuilder.cs
@@ -16,7 +16,7 @@ namespace Microsoft.Azure.Devices.Client
     /// <summary>
     /// Builds a connection string for the IoT Hub service based on the properties populated by the user.
     /// </summary>
-    public sealed class IotHubConnectionStringBuilder
+    public sealed class IotHubConnectionStringBuilder : IDisposable
     {
         private const char ValuePairDelimiter = ';';
         private const char ValuePairSeparator = '=';
@@ -408,5 +408,18 @@ private static bool ParseX509(string input, bool ignoreCase, out bool usingX509C
             // Always returns true, but must return a bool because it is used in a delegate that requires that return.
             return true;
         }
+
+        /// <summary>
+        /// Dispose necessary objects.
+        /// </summary>
+        public void Dispose()
+        {
+#if !NET451
+            Certificate?.Dispose();
+            Certificate = null;
+#endif
+            AuthenticationMethod?.Dispose();
+            AuthenticationMethod = null;
+        }
     }
 }
diff --git a/iothub/device/src/ModuleAuthenticationWithRegistrySymmetricKey.cs b/iothub/device/src/ModuleAuthenticationWithRegistrySymmetricKey.cs
index 921dfbd772..7085fb758e 100644
--- a/iothub/device/src/ModuleAuthenticationWithRegistrySymmetricKey.cs
+++ b/iothub/device/src/ModuleAuthenticationWithRegistrySymmetricKey.cs
@@ -128,5 +128,11 @@ private void SetModuleId(string moduleId)
 
             _moduleId = moduleId;
         }
+
+        /// <inheritdoc />
+
+        public void Dispose()
+        {
+        }
     }
 }
diff --git a/iothub/device/src/ModuleAuthenticationWithToken.cs b/iothub/device/src/ModuleAuthenticationWithToken.cs
index e6516994b6..f353e2b184 100644
--- a/iothub/device/src/ModuleAuthenticationWithToken.cs
+++ b/iothub/device/src/ModuleAuthenticationWithToken.cs
@@ -55,6 +55,12 @@ public string Token
             set => SetToken(value);
         }
 
+        /// <inheritdoc />
+
+        public void Dispose()
+        {
+        }
+
         /// <summary>
         /// Populates an <see cref="IotHubConnectionStringBuilder"/> instance based on the properties of the current instance.
         /// </summary>