Use identity-based authentication for Event Grid topics#
Security · Event Grid · Preview · 2021_12
Authenticate publishing clients with Azure AD identities.
Description#
To publish events to Event Grid access keys, SAS tokens, or Azure AD identities can be used. With Azure AD authentication, the identity is validated against Azure AD identity provider. Using Azure AD identities centralizes identity management and auditing.
Once you decide to use Azure AD authentication, you can disable authentication using keys or SAS tokens.
Recommendation#
Consider only using Azure AD identities to publish events to Event Grid. Then disable authentication based on access keys or SAS tokens.
Examples#
Configure with Azure template#
To deploy Event Grid Topics that pass this rule:
- Set the
properties.disableLocalAuth
property totrue
.
For example:
{
"type": "Microsoft.EventGrid/topics",
"apiVersion": "2021-06-01-preview",
"name": "[parameters('topicName')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"disableLocalAuth": true,
"publicNetworkAccess": "Disabled",
"inputSchema": "CloudEventSchemaV1_0"
}
}
Configure with Bicep#
To deploy Event Grid Topics that pass this rule:
- Set the
properties.disableLocalAuth
property totrue
.
For example:
resource eventGrid 'Microsoft.EventGrid/topics@2021-06-01-preview' = {
name: topicName
location: location
identity: {
type: 'SystemAssigned'
}
properties: {
disableLocalAuth: true
publicNetworkAccess: 'Disabled'
inputSchema: 'CloudEventSchemaV1_0'
}
}
Notes#
This Azure feature is currently in preview.
Links#
- Use identity-based authentication
- Authentication and authorization with Azure Active Directory
- Disable key and shared access signature authentication
- Azure template reference