Securely Routing Graph Events to Azure Function via Event Grid

Beetus A.S. (Antony) 0

I have a partner topic for receiving Graph events. Currently, there is an Azure Function endpoint set to handle these events that is open to all networks. However, the goal is to restrict traffic to only within a VNET and from Graph events. If the Azure Function is moved to a dedicated VNET, can these events still route through to the Azure Function? Is it possible to use a service tag or similar to allow Event Grid to reach the Azure Function even though it's VNET-enabled? I understand that the endpoint should remain publicly accessible. Additionally, I noticed that there's an option to include a managed identity. Does this mean that only authorized connections from this identity can access the function if it is moved to the VNET?

Thanks,
Antony

JananiRamesh-MSFT 28,081 Reputation points

2024-11-11T13:56:49.94+00:00

@Beetus A.S. (Antony) Thanks for reaching out. As you mentioned for Azure Event Grid, the endpoint needs to be publicly accessible.

there are two ways here:

one using Azure Relay to deliver to a private webhook, by changing the EventGridTrigger to an HTTPTrigger. For more information please refer: Send events to webhooks hosted in private destinations - Azure Event Grid | Microsoft Learn.

Or Forward the events from the partner topic to a namespace and use pull delivery to consume the events directly from the VNET and removing the Azure Function.

Hope this helps! Please let me know incase of further queries, I would be happy to assist you.
JananiRamesh-MSFT 28,081 Reputation points

2024-11-13T17:10:11.8466667+00:00

@Beetus A.S. (Antony) Just checking to see if you have chance to see previous response and helped. Please let us know if you have further queries.

Share via

Securely Routing Graph Events to Azure Function via Event Grid

Your answer