Use identity-based authentication for Event Grid topics

Security · Event Grid · 2022_09

Authenticate publishing clients with Azure AD identities.

Description

To publish events to Event Grid access keys, SAS tokens, or Azure AD identities can be used. With Azure AD authentication, the identity is validated against the Microsoft Identity Platform. Using Azure AD identities centralizes identity management and auditing.

Once you decide to use Azure AD authentication, you can disable authentication using keys or SAS tokens.

Recommendation

Consider only using Azure AD identities to publish events to Event Grid. Then disable authentication based on access keys or SAS tokens.

Examples

Configure with Azure template

To deploy Event Grid Topics that pass this rule:

• Set the properties.disableLocalAuth property to true.

For example:

Azure Template snippet

{
    "type": "Microsoft.EventGrid/topics",
    "apiVersion": "2021-06-01-preview",
    "name": "[parameters('topicName')]",
    "location": "[parameters('location')]",
    "identity": {
        "type": "SystemAssigned"
    },
    "properties": {
        "disableLocalAuth": true,
        "publicNetworkAccess": "Disabled",
        "inputSchema": "CloudEventSchemaV1_0"
    }
}

Configure with Bicep

To deploy Event Grid Topics that pass this rule:

• Set the properties.disableLocalAuth property to true.

For example:

Azure Bicep snippet

resource eventGrid 'Microsoft.EventGrid/topics@2021-06-01-preview' = {
  name: topicName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    disableLocalAuth: true
    publicNetworkAccess: 'Disabled'
    inputSchema: 'CloudEventSchemaV1_0'
  }
}

Links

• Use identity-based authentication
• IM-1: Use centralized identity and authentication system
• Authentication and authorization with Azure Active Directory
• Disable key and shared access signature authentication
• Azure deployment reference

---

Last update: 2022-10-17

Comments