Examkin

Question

Difficulty: MediumImplement Azure Event Grid Solutions

You are developing a solution that routes resource group lifecycle events to an Azure Storage Queue. The storage account is secured, and public access is restricted. You need to configure Azure Event Grid to deliver these events securely using a user-assigned managed identity. Which sequence of steps should you perform to complete the configuration? To answer, arrange all actions from the list of actions in the correct order.

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Associate the user-assigned managed identity with the Event Grid system topic.
  3. 3Assign the Storage Queue Data Message Sender role to the user-assigned managed identity on the target storage queue.
  4. 4Create the event subscription, specifying the storage queue as the endpoint and selecting the user-assigned identity for delivery.

Answer

To configure secure Event Grid delivery to an Azure Storage Queue using a user-assigned managed identity, you must first create the identity, associate it with the Event Grid system topic, grant it the Storage Queue Data Message Sender role on the queue, and then create the event subscription specifying the queue endpoint and the identity for delivery.
First, the user-assigned managed identity must be created in Microsoft Entra ID. Next, this identity must be associated with the Event Grid system topic so that the topic can leverage it. Then, the identity must be granted the Storage Queue Data Message Sender role at the scope of the target storage queue to allow message writing. Finally, the event subscription can be created, referencing the target queue as the endpoint and using the user-assigned managed identity for delivery.

Step-by-Step Solution

1
Create the user-assigned managed identity
A standalone user-assigned managed identity resource is created in Microsoft Entra ID.
The identity must exist before it can be assigned permissions or associated with other Azure resources.
2
Associate with system topic
The Event Grid system topic is configured with the user-assigned managed identity.
Azure Event Grid requires the identity to be associated with the topic from which the event subscription is created.
3
Assign RBAC role
The identity is granted the Storage Queue Data Message Sender role on the target queue.
Event Grid must have authorization to write to the queue, and the minimum privilege role for this action is Storage Queue Data Message Sender.
4
Create the subscription
The event subscription is created and successfully validated.
During creation, Event Grid validates that the endpoint is reachable and that the configured identity has the necessary permissions to write to it.

Key Concept

Configuring managed identities for Event Grid delivery
Rate this question

Topics

Implement Azure Event Grid Solutions