Examkin

Question

Difficulty: MediumImplement Azure Event Grid Solutions

You are developing an integration solution that uses Azure Event Grid to route custom events to a Webhook endpoint. To secure the webhook, you must implement Microsoft Entra ID authentication so that the Webhook only accepts authorized requests from Event Grid. You need to configure the authentication and the subscription.

Which sequence of steps should you perform to complete the configuration?

  1. 1Register a new application in Microsoft Entra ID to represent the webhook endpoint.
  2. 2Define an application role within the registered webhook application.
  3. 3Grant the Azure Event Grid Service Principal the defined application role on the webhook application.
  4. 4Create the Event Grid subscription, specifying the webhook endpoint and configuring the Microsoft Entra ID authentication details.

Answer

The correct sequence of steps is: Register a new application in Microsoft Entra ID to represent the webhook endpoint, define an application role within the registered webhook application, grant the Azure Event Grid Service Principal the defined application role on the webhook application, and finally create the Event Grid subscription, specifying the webhook endpoint and configuring the Microsoft Entra ID authentication details.
To secure an Event Grid Webhook using Microsoft Entra ID, you must register the Webhook application first to establish its identity. Next, you define an application role inside the registration. You then grant the Azure Event Grid Service Principal this role. Finally, you create the subscription using the Webhook's Entra ID application details. This order ensures that the validation handshake succeeds because Event Grid is already authorized to call the endpoint.

Step-by-Step Solution

1
Register the webhook application in Microsoft Entra ID.
An application registration is created with a unique Application (Client) ID.
This establishes the identity of the webhook endpoint in the Microsoft Entra ID tenant.
2
Expose an application role in the webhook application registration.
An authorized role (e.g., AzureEventGridSecureWebhookSubscriber) is defined.
The role must exist before it can be assigned to the caller service principal.
3
Assign the defined application role to the Azure Event Grid Service Principal.
Event Grid is granted permission to call the secure webhook endpoint.
The service must have permission to call the endpoint to complete the upcoming validation handshake.
4
Create the Event Grid subscription with Entra ID endpoint authentication properties.
The event subscription is created, and the validation handshake completes successfully.
This is the final step where Event Grid validates the webhook endpoint using the authorized identity context.

Key Concept

Microsoft Entra ID secured webhook endpoints in Azure Event Grid
Rate this question

Topics

Implement Azure Event Grid Solutions