Skip to content

Commit 80e7a86

Browse files
thomps23thomps23
authored
Merge pull request #299776 from MicrosoftDocs/release-build-2025-event-grid
[Build 2025 ship room] - Azure Event Grid - 419255
2 parents 851fd52 + bbb0cda commit 80e7a86

32 files changed

+498
-95
lines changed

‎articles/event-grid/.openpublishing.redirection.event-grid.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,6 @@
1010
"redirect_url": "/azure/event-grid/transport-layer-security-configure-minimum-version",
1111
"redirect_document_id": false
1212
},
13-
{
14-
"source_path": "configure-network-security-perimeter.md",
15-
"redirect_url": "/azure/event-grid/network-security",
16-
"redirect_document_id": false
17-
},
1813
{
1914
"source_path": "webhook-event-delivery.md",
2015
"redirect_url": "/azure/event-grid/end-point-validation-cloud-events-schema",

‎articles/event-grid/authenticate-with-namespaces-using-webhook-authentication.md

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
---
2+
title: Authenticate with namespaces using webhook auth
3+
description: This article shows you how to authenticate with Azure Event Grid namespace using webhook or Azure function.
4+
ms.topic: how-to
5+
ms.custom: build-2025
6+
ms.date: 04/30/2025
7+
author: Connected-Seth
8+
ms.author: seshanmugam
9+
---
10+
11+
# Authenticate with MQTT broker using custom webhook authentication (Preview)
12+
This article shows how to authenticate with Azure Event Grid namespace using webhook or Azure function.
13+
14+
Webhook authentication allows external HTTP endpoints (webhooks or functions) to authenticate MQTT connections dynamically. This method uses Microsoft Entra ID JWT validation to ensure secure access.
15+
16+
When a client attempts to connect, the broker invokes a user-defined HTTP endpoint that validates credentials such SAS tokens, usernames/passwords, or even performs Certificate Revocation List (CRL) checks. The webhook evaluates the request and returns a decision to allow or deny the connection, along with optional metadata for fine-grained authorization. This approach supports flexible and centralized authentication policies across diverse device fleets and use cases.
17+
18+
> [!NOTE]
19+
> This feature is currently in preview.
20+
21+
## Prerequisites
22+
23+
To use custom webhook authentication for namespaces, you need to have the following prerequisites:
24+
25+
- An Event Grid namespace with either system-assigned or user-assigned managed identity.
26+
- The External Webhook or Azure function.
27+
- Grant access to the Event Grid Namespace’s Managed identity to Azure function /Webhook.
28+
29+
## High-level steps
30+
31+
To use custom webhook authentication for namespaces, follow these steps:
32+
33+
1. Create a namespace and configure its subresources.
34+
1. Enable managed identity on your Event Grid namespace.
35+
1. Grant the managed identity access to your Azure function or Webhook.
36+
1. Configure custom webhook settings on your Event Grid namespace
37+
1. Connect your clients to the Event Grid namespace and get authenticated via the webhook or function.
38+
39+
## Create a namespace and configure its subresources
40+
Follow instructions from [Quickstart: Publish and subscribe to MQTT messages on Event Grid Namespace with Azure portal](mqtt-publish-and-subscribe-portal.md) to create a namespace and configure its subresources. Skip the certificate and client creation steps as the client identities come from the provided token. Client attributes are based on the custom claims in the client token. The client attributes are used in the client group query, topic template variables, and routing enrichment configuration.
41+
42+
## Enable managed identity on your Event Grid namespace
43+
Use the following command to enable system-assigned managed identity on your Event Grid namespace:
44+
45+
```azurecli-interactive
46+
az eventgrid namespace update --resource-group <resource group name> --name <namespace name> --identity "{type:systemassigned}"
47+
```
48+
49+
For information on configuring system and user-assigned identities using the Azure portal, see [Enable managed identity for an Event Grid namespace](event-grid-namespace-managed-identity.md).
50+
51+
## Grant the managed identity appropriate access to function or webhook
52+
Grant the managed identity of your Event Grid namespace the appropriate access to the target Azure function or webhook.
53+
54+
### Use Azure portal
55+
56+
1. Identify the managed identity.
57+
1. Navigate to your **Event Grid namespace** in the [Azure portal](https://portal.azure.com).
58+
1. On the **Event Grid namespace** page, select **Identity** on the left menu.
59+
1. Copy the **object ID** of the managed identity.
60+
1. Navigate to your **Azure function app** or the **app service hosting the Webhook**.
61+
1. Assign appropriate role to the managed identity.
62+
1. On the **Function App** page, select **Access Control (IAM)** on the left menu, and then select **Add Role Assignment**.
63+
1. Choose a role like **Contributor** or **Function App Contributor** (or a custom role with required permissions).
64+
1. Scope it appropriately (for example, at the resource or resource group level).
65+
1. Select **Assign access to**, and then select user, group, or service principal.
66+
1. Paste the object ID of the managed identity for your Event Grid namespace.
67+
1. **Save** and **Confirm** access. Complete the role assignment and confirm access is reflected under the **Role assignments** tab.
68+
69+
### Use Azure CLI
70+
71+
1. Get the object ID of the managed identity for your Event Grid namespace.
72+
73+
```azurecli
74+
az eventgrid namespace identity show \
75+
--name <eventgrid-namespace-name> \
76+
--resource-group <eventgrid-resource-group> \
77+
--query principalId \
78+
--output tsv
79+
```
80+
81+
Save the output (let’s call it EG_MI_ID).
82+
2. Assign a role (for example, Contributor) to the managed identity on the Azure function or Webhook resource.
83+
84+
```azurecli
85+
az role assignment create \
86+
--assignee-object-id <EG_MI_ID> \
87+
--assignee-principal-type ServicePrincipal \
88+
--role "Contributor" \ # or use a least-privileged custom role
89+
--scope $(az functionapp show \
90+
--name <function-app-name> \
91+
--resource-group <function-app-resource-group> \
92+
--query id --output tsv)
93+
```
94+
You can replace **Contributor** with a custom role name that grants only required permissions (for example, **Azure Event Grid Event Subscription Contributor** for webhooks).
95+
96+
## Configure custom webhook authentication settings on your Event Grid namespace
97+
In this step, you configure custom webhook authentication settings on your Event Grid namespace using Azure portal and Azure CLI. You need to create the namespace first and then update it using the following steps.
98+
99+
### Use Azure portal
100+
101+
1. Navigate to your Event Grid namespace in the [Azure portal](https://portal.azure.com).
102+
1. On the **Event Grid Namespace** page, select **Configuration** on the left menu.
103+
1. In the **Custom Webhook authentication** section, specify values for the following properties:
104+
1. Select **Managed identity** type.
105+
1. For **Webhook URL**, enter the value of the URL endpoint where the Event Grid service sends authenticated webhook requests using the specified managed identity.
106+
1. For **Token audience URI**, enter the value of Microsoft Entra application ID or URI to get the access token to be included as the bearer token in delivery requests.
107+
1. For **Microsoft Entra tenant ID**, enter the value of Microsoft Entra tenant ID used to acquire the bearer token for authenticated webhook delivery.
108+
1. Select **Apply**.
109+
110+
:::image type="content" source="./media/authenticate-with-namespaces-using-webhook-authentication/configure-webhook-authentication.png" alt-text="Screenshot that shows the configuration of webhook authentication for an Event Grid namespace." lightbox="./media/authenticate-with-namespaces-using-webhook-authentication/configure-webhook-authentication.png":::
111+
112+
### Use Azure CLI
113+
114+
Use the following command to update your namespace with the custom webhook authentication configuration.
115+
116+
```azurecli
117+
az eventgrid namespace update \
118+
--resource-group <resource-group-name> \
119+
--name <namespace-name> \
120+
--api-version 2025-04-01-preview \
121+
--identity-type UserAssigned \
122+
--identity-user-assigned-identities "/subscriptions/XXXXXXXXXXX/resourcegroups/XXXXXXXXXXX/providers/Microsoft.ManagedIdentity/userAssignedIdentities/XXXXXXXXXXX={}" \
123+
--set properties.isZoneRedundant=true \
124+
properties.topicSpacesConfiguration.state=Enabled \
125+
properties.topicSpacesConfiguration.clientAuthentication.webHookAuthentication.identity.type=UserAssigned \
126+
properties.topicSpacesConfiguration.clientAuthentication.webHookAuthentication.identity.userAssignedIdentity="/subscriptions/XXXXXXXXXXX/resourcegroups/XXXXXXXXXXX/providers/Microsoft.ManagedIdentity/userAssignedIdentities/XXXXXXXXXXX" \
127+
properties.topicSpacesConfiguration.clientAuthentication.webHookAuthentication.endpointUrl="https://XXXXXXXXXXX" \
128+
properties.topicSpacesConfiguration.clientAuthentication.webHookAuthentication.azureActiveDirectoryApplicationIdOrUri="api://XXXXXXXXXXX/.default" \
129+
properties.topicSpacesConfiguration.clientAuthentication.webHookAuthentication.azureActiveDirectoryTenantId="XXXXXXXXXXX"
130+
```
131+
132+
Replace <NAMESPACE_NAME> and <RESOURCE_GROUP_NAME> with your actual values, and fill in the placeholders in the subscription/resource group/identity/app ID/URL/tenant ID. To enhance the performance and reliability of webhook-based authentication for Azure Event Grid MQTT Broker, we strongly recommend enabling HTTP/2 support for your webhook endpoint.
133+
134+
## Webhook API details
135+
136+
### Request Headers
137+
138+
- Authorization: Bearer token
139+
- token is an Entra ID token for the managed identity configured to call the webhook.
140+
141+
### Request payload
142+
143+
```json
144+
{
145+
"clientId": "<string>",
146+
"userName": "<string>",
147+
"password": "<base64 encoded bytes>",
148+
"authenticationMethod": "<string>",
149+
"authenticationData": "<base64 encoded bytes>",
150+
"clientCertificate": "<certificate in PEM format>",
151+
"clientCertificateChain": "<certificates from chain in PEM format>"
152+
}
153+
```
154+
155+
### Payload field descriptions
156+
157+
| Field | Required/Optional | Description |
158+
|-----------------|------------------|---------|
159+
| clientId | Required | Client ID from MQTT CONNECT packet. |
160+
| userName | Optional | Username from MQTT CONNECT packet. |
161+
| password | Optional | Password from MQTT CONNECT packet in base64 encoding. |
162+
| authenticationMethod | Optional | Authentication method from MQTT CONNECT packet (MQTT5 only). |
163+
| authenticationData | Optional | Authentication data from MQTT CONNECT packet in base64 encoding (MQTT5 only). |
164+
| clientCertificate | Optional | Client certificate in PEM format. |
165+
| clientCertificateChain| Optional | Additional certificates provided by the client required for building the chain from the client certificate to the CA certificate. |
166+
| userProperties | Optional | User properties from CONNECT packet (MQTT5 only). |
167+
168+
### Response payload
169+
170+
#### Successful response
171+
172+
```json
173+
HTTP/1.1 200 OK
174+
Content-Type: application/json
175+
176+
{
177+
"decision": "allow",
178+
"clientAuthenticationName": "<string>",
179+
"attributes": {
180+
"attr": "<int/string/array_of_strings>",
181+
...
182+
},
183+
"expiration": "<unix time format>"
184+
}
185+
```
186+
187+
#### Denied response
188+
189+
```json
190+
HTTP/1.1 400 Bad Request
191+
Content-Type: application/json
192+
193+
{
194+
"decision": "deny",
195+
"errorReason": "<string>"
196+
}
197+
```
198+
199+
### Response field descriptions
200+
201+
202+
| Field | Description |
203+
|---------------------------|------------------------------------|
204+
| Decision (required) | Authentication decision. Can be either **allow** or **deny**. |
205+
| clientAuthenticationName | Client authentication name (identity name). (Required when Decision is set to allow). |
206+
| attributes | Dictionary with attributes. Key is the attribute name, and the value can be an int/string/array. (Optional when Decision is set to allow). |
207+
| expiration | Expiration date in Unix time format. (Optional when Decision is set to allow) |
208+
| errorReason | Error message if decision is set to deny. This error is logged. (Optional when Decision is set to deny) |
209+
210+
### Examples of supported attribute types:
211+
212+
```json
213+
"num_attr_pos": 1,
214+
"num_attr_neg": -1,
215+
"str_attr": "str_value",
216+
"str_list_attr": [
217+
"str_value_1",
218+
"str_value_2"
219+
]
220+
```
221+
222+
All correct data types (number that fits int32, string, array of strings) are used as attributes. In the example, `num_attr_pos`, `num_attr_neg`, `str_attr`, `str_list_attr` claims have correct data types and are used as attributes.
223+
224+
225+
226+
## Related content
227+
- [MQTT client authentication](mqtt-client-authentication.md)
228+
- [Authenticate client using custom JWT](mqtt-client-custom-jwt.md)

‎articles/event-grid/choose-right-tier.md

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,7 @@
22
title: Choose the right Event Grid tier for your solution
33
description: Describes how to choose the right tier based on resource features and use cases.
44
ms.topic: overview
5-
ms.custom:
6-
- build-2024
7-
ms.date: 05/08/2024
5+
ms.date: 04/30/2025
86
---
97

108
# Choose the right Event Grid tier for your solution
@@ -15,10 +13,10 @@ Azure Event Grid has two tiers with different capabilities. This article shares
1513

1614
Azure Event Grid includes the following functionality through Event Grid namespaces:
1715

18-
* An MQTT pub-sub broker that supports bidirectional communication using MQTT v3.1.1 and v5.0.
16+
* A Message Queueing Telemetry Transport (MQTT) pub-sub broker that supports bidirectional communication using MQTT v3.1.1 and v5.0.
1917
* CloudEvents publication using HTTP.
2018
* Pull delivery using HTTP.
21-
* Push delivery to Event Hubs using AMQP.
19+
* Push delivery to Event Hubs using Advanced Messaging Queueing Protocol (AMQP).
2220

2321
Use this tier if any of the following statements is true:
2422

@@ -54,20 +52,20 @@ The standard tier of Event Grid is focused on providing the following features:
5452

5553
The basic tier is focused on providing push delivery support to trigger actions based on events. For a detailed breakdown of which quotas and limits are included in each Event Grid resource, see [Quotas and limits](quotas-limits.md).
5654

57-
| Feature | Standard | Basic |
58-
|------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|----------------------------------------|
59-
| Throughput | High, up to 40 MB/s (ingress) and 80 MB/s (egress) | Low, up to 5 MB/s (ingress and egress) |
60-
| MQTT v5 and v3.1.1 | Yes | |
61-
| Pull delivery | Yes | |
62-
| Publish and subscribe to custom events | Yes | Yes |
55+
| Feature | Standard | Basic |
56+
|-----------|-----------|-------|
57+
| Throughput | High, up to 40 MB/s (ingress) and 80 MB/s (egress) | Low, up to 5 MB/s (ingress and egress) |
58+
| MQTT v5 and v3.1.1 | Yes | |
59+
| Pull delivery | Yes | |
60+
| Publish and subscribe to custom events | Yes | Yes |
6361
| Push delivery to Webhooks |Yes | Yes
64-
| Push delivery to Event Hubs | Yes | Yes |
65-
| Push delivery to Azure services (Functions, Service Bus queues and topics, relay hybrid connections, and storage queues) | | Yes |
62+
| Push delivery to Event Hubs | Yes | Yes |
63+
| Push delivery to Azure services (Functions, Service Bus queues and topics, relay hybrid connections, and storage queues) | | Yes |
6664
| Maximum message retention | 7 days on namespace topics | 1 day
67-
| Subscribe to Azure system events | | Yes |
68-
| Subscribe to partner events | | Yes |
69-
| Domain scope subscriptions | | Yes |
70-
65+
| Subscribe to Azure system events | | Yes |
66+
| Subscribe to partner events | | Yes |
67+
| Domain scope subscriptions | | Yes |
68+
| Pull delivery to Fabric Eventstream | Yes | No |
7169

7270
## Next steps
7371

0 commit comments

Comments
 (0)