Examkin

Question

Difficulty: MediumImplement Azure Event Grid Solutions

You are developing a solution that uses Azure Event Grid to route system events from an Event Grid custom topic to a Webhook. You must ensure that any events that cannot be delivered are routed to a container named "deadletters" in an Azure Storage account named "mystorage2026". The solution must secure access to the storage account by using a system-assigned managed identity associated with the custom topic. Which four actions should you perform in sequence? To answer, arrange the actions in the correct order.

  1. 1Enable the system-assigned managed identity for the Event Grid custom topic.
  2. 2Assign the Storage Blob Data Contributor role to the custom topic's managed identity on the storage account.
  3. 3Create the Event Grid event subscription and specify the dead-letter endpoint pointing to the deadletters blob container.
  4. 4Configure the event subscription's dead-letter identity settings to use the System Assigned identity type.

Answer

To configure Event Grid dead-lettering using a system-assigned managed identity, you must first enable the system-assigned managed identity on the Event Grid custom topic. Next, assign the Storage Blob Data Contributor role to the custom topic's managed identity at the scope of the destination storage account. Then, create the Event Grid event subscription with dead-lettering configured to the target blob container. Finally, configure the event subscription's dead-letter identity settings to use the System Assigned identity type.
First, the system-assigned identity must be enabled on the Event Grid custom topic so that an identity object is registered in Microsoft Entra ID. Second, the newly created identity must be granted the Storage Blob Data Contributor role on the storage account so it has permission to write logs. Third, the event subscription must be created with dead-lettering enabled pointing to the destination container. Finally, the event subscription's dead-letter identity setting must be configured to use the System Assigned identity to route requests securely.

Step-by-Step Solution

1
Enable the system-assigned managed identity for the Event Grid custom topic.
A system-assigned identity is created in Microsoft Entra ID for the custom topic, yielding an identity principal.
You must create the managed identity principal before you can assign RBAC roles to it or use it for authentication.
2
Assign the Storage Blob Data Contributor role to the custom topic's managed identity on the storage account.
The identity principal is granted write permissions on the Azure Storage account.
Event Grid needs the Storage Blob Data Contributor role to write undelivered events to the dead-letter blob container.
3
Create the Event Grid event subscription and specify the dead-letter endpoint pointing to the deadletters blob container.
The event subscription is created with the specified active event destination and dead-letter destination.
This establishes the event delivery routing rules and designates the fallback container for failed events.
4
Configure the event subscription's dead-letter identity settings to use the System Assigned identity type.
The subscription is configured to authenticate write requests to the dead-letter storage account using the custom topic's system-assigned identity.
By default, Event Grid uses SAS tokens to write to the dead-letter container. To use the managed identity, you must explicitly configure the identity settings on the subscription.

Key Concept

Configuring Event Grid dead-lettering with managed identities
Rate this question

Topics

Implement Azure Event Grid Solutions