Edit

Share via

Cross-tenant event delivery using a managed identity

  • Article

This article provides information on delivery of events where Azure Event Grid basic resources like topics, domains, system topics, and partner topics are in one tenant and the Azure destination resource is in another tenant.

The following sections show you how to implement a sample scenario where an Azure Event Grid topic with a user-assigned identity as a federated credential delivers events to an Azure Storage Queue destination hosted in another tenant. Here are the high-level steps:

  1. Create an Azure Event Grid topic with a user-assigned managed identity in Tenant A.
  2. Create a multitenant app with a federated client credential.
  3. Create an Azure Storage Queue destination in Tenant B.
  4. While creating an event subscription to the topic, enable cross-tenant delivery and configure an endpoint.

Note

  • This feature is currently in preview.
  • Cross-tenant delivery is currently available for the following endpoints: Service Bus topics and queues, Event Hubs, and Storage queues.

Create a topic with a user-assigned identity (Tenant A)

Create a user-assigned identity by following instructions in the Manage user-assigned managed identities article. Then, enable a user-assigned managed identity while creating a topic or updating an existing topic by using steps in the following procedure.

Enable user-assigned identity for a new topic

  1. On the Security page of the topic or domain creation wizard, select Add user assigned identity.

  2. In the Select user assigned identity window, select the subscription that has the user-assigned identity, select the user-assigned identity, and then choose Select.

    Screenshot showing the Enable user-assigned identity option selected.

Enable user-assigned identity for an existing topic

  1. On the Identity page, switch to the User assigned tab in the right pane, and then select + Add on the toolbar.

    Screenshot showing the User Assigned Identity tab.

  2. In the Add user managed identity window, follow these steps:

    1. Select the Azure subscription that has the user-assigned identity.
    2. Select the user-assigned identity.
    3. Select Add.

  3. Refresh the list in the User assigned tab to see the added user-assigned identity.

For more information, see the following articles:

Create a multitenant Application

  1. Create a Microsoft Entra app and update the registration to be multitenant. For details, see Enable multitenant registration.

    Screenshot that shows the Microsoft Entra app authentication setting set to Multitenant.

  2. Create the federated identity credential relationship between multitenant app and the user-assigned identity of the Event Grid topic using Graph API.

    Screenshot that shows the sample POST method to enable federated identity credential relationship between multitenant app and user-assigned identity.

    • In the URL, use the multitenant app object ID.
    • For Name, provide a unique name for the federated client credential.
    • For Issuer, use https://login.microsoftonline.com/TENANTAID/v2.0 where TENANTAID is the ID of the tenant where the user-assigned identity is located.
    • For Subject, specify the client ID of the user-assigned identity.

    Verify and wait for the API call to succeed.

  3. Once the API call succeeds, proceed to verify that the federated client credential is set up correctly on the multitenant app.

    Screenshot that shows the certificates and secrets page of the multitenant app.

    Note

    The subject identifier is the client ID of the user-assigned identity on the topic.

Create destination storage account (Tenant B)

Create a storage account in a tenant that's different from the tenant that has the source Event Grid topic and user-assigned identity. You create an event subscription to the topic (in tenant A) using the storage account (in tenant B) later.

  1. Create a storage account by following instructions from the Create a storage account article.

  2. Using the Access Control (IAM) page, add the multitenant app to the appropriate role so that the app can send events to the storage account. For example: Storage Account Contributor, Storage Queue Data Contributor, Storage Queue Data Message Sender. For instructions, see Assign an Azure role for an Azure queue.

    Screenshot that shows the Access Control (IAM) page for the storage account.

Enable cross-tenant delivery and configure the endpoint

Create an event subscription on the topic with federated client credential information passed to deliver to the destination storage account.

  1. While creating an event subscription, enable cross-tenant delivery and select Configure an endpoint.

    Screenshot that shows the Create Event Subscription page with Cross-tenant delivery option enabled.

  2. On the Endpoint page, specify the subscription ID, resource group, storage account name, and the queue name in Tenant B.

    Screenshot that shows the Endpoint page.

  3. Now, in the Managed Identity for Delivery section, do these steps:

    1. For Managed identity type, select User Assigned.

    2. Select the user-assigned identity from the drop-down list.

    3. For Federated identity credentials, enter the multitenant application ID.

      Screenshot that shows the Create Event Subscription page with the managed identity specified.

  4. Select Create at the bottom of the page to create the event subscription.

    Now, publish event to topic and verify event is delivered successfully to destination storage account.