Use identity-based authentication for Event Hub namespaces#
Security · Event Hub · Rule · 2022_03
Authenticate Event Hub publishers and consumers with Azure AD identities.
Description#
To publish or consume events from Event Hubs cryptographic keys, or Azure AD identities can be used. Cryptographic keys include Shared Access Policy keys or Shared Access Signature (SAS) tokens. With Azure AD authentication, the identity is validated against Azure AD. Using Azure AD identities centralizes identity management and auditing.
Once you decide to use Azure AD authentication, you can disable authentication using keys or SAS tokens.
Recommendation#
Consider only using Azure AD identities to publish or consume events from Event Hub. Then disable authentication based on access keys or SAS tokens.
Examples#
Configure with Azure template#
To deploy Event Hub namespaces that pass this rule:
- Set the
properties.disableLocalAuth
property totrue
.
For example:
{
"type": "Microsoft.EventHub/namespaces",
"apiVersion": "2021-11-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned"
},
"sku": {
"name": "Standard"
},
"properties": {
"disableLocalAuth": true,
"isAutoInflateEnabled": true,
"maximumThroughputUnits": 10,
"zoneRedundant": true
}
}
Configure with Bicep#
To deploy Event Hub namespaces that pass this rule:
- Set the
properties.disableLocalAuth
property totrue
.
For example:
resource ns 'Microsoft.EventHub/namespaces@2021-11-01' = {
name: name
location: location
identity: {
type: 'SystemAssigned'
}
sku: {
name: 'Standard'
}
properties: {
disableLocalAuth: true
isAutoInflateEnabled: true
maximumThroughputUnits: 10
zoneRedundant: true
}
}
Links#
- Use identity-based authentication
- Authorize access to Event Hubs resources using Azure Active Directory
- Disabling Local/SAS Key authentication
- Azure deployment reference