How can I crate a partner topic for receiving Entra ID events with IoC?

Question

Hello there,

I follow this tutorial to receive Entra ID events through Event Grid Partner Topics:

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/event-grid/subscribe-to-microsoft-entra-id-events-portal.md

I would like to automate this using IaC, as we have multiple tenants that would like to follow this setup. However, I to re-produce the necessary steps. There is a generic API for doing so:
https://learn.microsoft.com/en-us/rest/api/eventgrid/controlplane/partner-topics/create-or-update?view=rest-eventgrid-controlplane-2022-06-15&tabs=HTTP

However, it requires a source that I don't have at this stage. In addition, all the other properties I would need to specify, such as resource path and enabling lifecycle events, are not part of this config.

What other options do I have?

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

To automate the creation of a Partner Topic for receiving Microsoft Entra ID events using IaC, you need to work around the limitations of the REST API. Here’s an approach that you can follow:

---

1. Understanding the Key Requirements

To create a Partner Topic, the key requirements are:

• A source (which represents the Entra ID event publisher)
• A resource path (where the events should be routed)
• Enabling lifecycle events (if needed)

Since Microsoft Entra ID is the event source, the challenge is that the REST API requires a source parameter, but at this stage, you don’t have direct access to it.

---

2. Possible Solutions

Here are a few approaches to automate the setup:

Option 1: Use Azure CLI / PowerShell for End-to-End Deployment

While the REST API requires a source, you can instead use Azure CLI or PowerShell to set up the Partner Topic.

Using Azure CLI

az eventgrid partner topic create
--name "<PARTNER_TOPIC_NAME>"
--resource-group "<RESOURCE_GROUP>"
--source "/providers/Microsoft.EntraID/domains/<DOMAIN_NAME>"
--location "<LOCATION>"

• The key issue here is determining <DOMAIN_NAME>, as it requires Entra ID permissions.

Using PowerShell:

If the source is unknown, this will fail.

New-AzEventGridPartnerTopic -ResourceGroupName "<RESOURCE_GROUP>" -Name "<PARTNER_TOPIC_NAME>" -Source "/providers/Microsoft.EntraID/domains/<DOMAIN_NAME>" ` -Location "<LOCATION>"

---

Option 2: Deploy Using Bicep or ARM Template

resource partnerTopic 'Microsoft.EventGrid/partnerTopics@2022-06-15' = { name: 'my-partner-topic' location: 'eastus' properties: { partnerRegistrationImmutableId: '<PARTNER_REGISTRATION_ID>' source: '/providers/Microsoft.EntraID/domains/<DOMAIN_NAME>' partnerTopicFriendlyDescription: 'Partner topic for Entra ID events' } }

Limitations:

• You need to pre-register the partner registration and get its immutable ID.
• You need the source, which is linked to the Entra ID domain.

---

Option 3: Register the Partner Namespace & Allow Tenants to Subscribe

Instead of creating the Partner Topic directly, you register a Partner Namespace and allow multiple tenants to subscribe.

Register as an Event Partner

• This is done in Microsoft Partner Center or via API.
  • You receive a partnerRegistrationImmutableId.
  Use Partner Registration to Enable Events from Entra ID

  - You create a partner namespace in Azure Event Grid.
  

Each Tenant Subscribes to the Partner Topic

• Once the partner namespace exists, each tenant subscribes via Event Grid Partner Topic Subscription.

This allows you to onboard multiple tenants dynamically without requiring manual configuration.

---

Best Approach

• If you own the source (a Microsoft Entra ID event publisher), you can directly create the Partner Topic via Azure CLI or Bicep.
• If you don’t have the source, use Partner Registration and let tenants subscribe dynamically.
• The IaC approach works better when combined with Partner Namespace Registration to avoid manual intervention.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.

Answer 2

Hi @Rudolf Biczok ,

To automate the creation of a Partner Topic for Microsoft Entra ID events using Infrastructure as Code (IaC), follow these steps:

• Partner Registration: Register as a partner and get your partner registration immutable ID.
• Create Partner Namespace: Use Azure CLI or an ARM template to create a partner namespace, which is needed for managing subscriptions.
• Create Partner Topic: After creating the partner namespace, create a partner topic using the source linked to the Entra ID domain.
• Tenant Subscription: Each tenant can subscribe to the partner topic you created, allowing for the dynamic onboarding of multiple tenants.

For detailed guidance on each step, refer to the official documentations:

• Partner Events overview for partners - Azure Event Grid
• Partner Events overview for customers - Azure Event Grid

I hope this answers your query! Let me know if you require any additional help or clarification.