Skip to content

Use identity-based authentication for Event Grid topics#

Security · Event Grid · Rule · 2022_09 · Important

Authenticate publishing clients with Azure AD identities.

Description#

To publish events to Event Grid access keys, SAS tokens, or Azure AD identities can be used. With Azure AD authentication, the identity is validated against the Microsoft Identity Platform. Using Azure AD identities centralizes identity management and auditing.

Once you decide to use Azure AD authentication, you can disable authentication using keys or SAS tokens.

Recommendation#

Consider only using Azure AD identities to publish events to Event Grid. Then disable authentication based on access keys or SAS tokens.

Examples#

Configure with Azure template#

To deploy Event Grid Topics that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

Azure Template snippet
{
  "type": "Microsoft.EventGrid/topics",
  "apiVersion": "2022-06-15",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "disableLocalAuth": true,
    "publicNetworkAccess": "Disabled",
    "inputSchema": "CloudEventSchemaV1_0"
  }
}

Configure with Bicep#

To deploy Event Grid Topics that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

Azure Bicep snippet
resource eventGrid 'Microsoft.EventGrid/topics@2022-06-15' = {
  name: name
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    disableLocalAuth: true
    publicNetworkAccess: 'Disabled'
    inputSchema: 'CloudEventSchemaV1_0'
  }
}

Configure with Azure Verified Modules

A pre-validated module supported by Microsoft is available from the Azure Bicep public registry. To reference the module, please use the following syntax:

br/public:avm/res/event-grid/topic:<version>

To use the latest version:

br/public:avm/res/event-grid/topic:0.8.1

Configure with Azure Policy#

To address this issue at runtime use the following policies:

Comments