Azure Event GridAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

# Placeholders: replace the names and the region with your own. Storage account names must be unique worldwide.
RG=rg-events-demo
LOC=centralindia
SA=stevents$RANDOM
APP=orders

az group create --name $RG --location $LOC

# 1. A storage account with a queue for the events and a container for the ones that cannot be delivered.
az storage account create --name $SA --resource-group $RG --location $LOC --sku Standard_LRS \
  --min-tls-version TLS1_2 --allow-blob-public-access false
az storage queue create --account-name $SA --name blob-created --auth-mode login
az storage container create --account-name $SA --name dead-letters --auth-mode login
SA_ID=$(az storage account show --name $SA --resource-group $RG --query id --output tsv)

# 2. A system topic: Azure itself publishes the storage account's events to it. There is no publisher code to write.
az eventgrid system-topic create --name $SA-events --resource-group $RG --location $LOC \
  --source $SA_ID --topic-type microsoft.storage.storageaccounts

# 3. Only new .jpg files in the uploads container go to the queue. Ten attempts or two hours, then the dead-letter container.
az eventgrid system-topic event-subscription create --name uploads-to-queue --resource-group $RG --system-topic-name $SA-events \
  --included-event-types Microsoft.Storage.BlobCreated \
  --subject-begins-with /blobServices/default/containers/uploads/ --subject-ends-with .jpg \
  --endpoint-type storagequeue --endpoint $SA_ID/queueServices/default/queues/blob-created \
  --max-delivery-attempts 10 --event-ttl 120 \
  --deadletter-endpoint $SA_ID/blobServices/default/containers/dead-letters

# 4. A custom topic for your own events, in the CloudEvents format, with a subscription for one event type.
az eventgrid topic create --name $APP-topic --resource-group $RG --location $LOC --input-schema cloudeventschemav1_0
TOPIC_ID=$(az eventgrid topic show --name $APP-topic --resource-group $RG --query id --output tsv)
az storage queue create --account-name $SA --name orders-placed --auth-mode login
az eventgrid event-subscription create --name orders-to-queue --source-resource-id $TOPIC_ID \
  --event-delivery-schema cloudeventschemav1_0 --included-event-types com.example.order.placed \
  --endpoint-type storagequeue --endpoint $SA_ID/queueServices/default/queues/orders-placed \
  --max-delivery-attempts 10 --event-ttl 120 --deadletter-endpoint $SA_ID/blobServices/default/containers/dead-letters

# 5. Publish one event. Event Grid answers 200 when it has accepted the event, not when a handler has finished with it.
ENDPOINT=$(az eventgrid topic show --name $APP-topic --resource-group $RG --query endpoint --output tsv)
KEY=$(az eventgrid topic key list --name $APP-topic --resource-group $RG --query key1 --output tsv)
curl -s -X POST "$ENDPOINT" -H "aeg-sas-key: $KEY" -H "Content-Type: application/cloudevents+json; charset=utf-8" \
  -d '{"specversion": "1.0", "id": "1001", "source": "/shop/orders", "type": "com.example.order.placed",
       "subject": "orders/A-1001", "datacontenttype": "application/json", "data": {"orderId": "A-1001", "total": 2500}}'
az storage message peek --account-name $SA --queue-name orders-placed --auth-mode login

# 6. Did anything fail to arrive? The topic's metrics tell you: failed attempts, dropped events and dead-lettered events.
az monitor metrics list --resource $TOPIC_ID --metric DeliveryAttemptFailCount DroppedEventCount DeadLetteredCount \
  --interval PT5M --aggregation Total

# MQTT and pull delivery live in Event Grid namespaces. Create one with the Terraform tab or with the eventgrid CLI extension.

# Placeholders: pass in your own names and region. Storage account names must be unique worldwide.
variable "location" {
  type    = string
  default = "centralindia"
}

variable "storage_account_name" {
  type = string
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "events" {
  name     = "rg-events-demo"
  location = var.location
}

resource "azurerm_storage_account" "events" {
  name                            = var.storage_account_name
  resource_group_name             = azurerm_resource_group.events.name
  location                        = azurerm_resource_group.events.location
  account_tier                    = "Standard"
  account_replication_type        = "LRS"
  min_tls_version                 = "TLS1_2"
  allow_nested_items_to_be_public = false
}

resource "azurerm_storage_queue" "blob_created" {
  name                 = "blob-created"
  storage_account_name = azurerm_storage_account.events.name
}

resource "azurerm_storage_queue" "orders_placed" {
  name                 = "orders-placed"
  storage_account_name = azurerm_storage_account.events.name
}

resource "azurerm_storage_container" "dead_letters" {
  name                  = "dead-letters"
  storage_account_name  = azurerm_storage_account.events.name
  container_access_type = "private"
}

# Azure publishes the storage account's events to this system topic by itself.
resource "azurerm_eventgrid_system_topic" "storage" {
  name                   = "${var.storage_account_name}-events"
  resource_group_name    = azurerm_resource_group.events.name
  location               = azurerm_resource_group.events.location
  source_arm_resource_id = azurerm_storage_account.events.id
  topic_type             = "Microsoft.Storage.StorageAccounts"
}

resource "azurerm_eventgrid_system_topic_event_subscription" "uploads" {
  name                 = "uploads-to-queue"
  system_topic         = azurerm_eventgrid_system_topic.storage.name
  resource_group_name  = azurerm_resource_group.events.name
  included_event_types = ["Microsoft.Storage.BlobCreated"]

  subject_filter {
    subject_begins_with = "/blobServices/default/containers/uploads/"
    subject_ends_with   = ".jpg"
  }

  storage_queue_endpoint {
    storage_account_id = azurerm_storage_account.events.id
    queue_name         = azurerm_storage_queue.blob_created.name
  }

  retry_policy {
    max_delivery_attempts = 10
    event_time_to_live    = 120
  }

  storage_blob_dead_letter_destination {
    storage_account_id          = azurerm_storage_account.events.id
    storage_blob_container_name = azurerm_storage_container.dead_letters.name
  }
}

# A custom topic for your own events, in the CloudEvents format.
resource "azurerm_eventgrid_topic" "orders" {
  name                = "orders-topic"
  resource_group_name = azurerm_resource_group.events.name
  location            = azurerm_resource_group.events.location
  input_schema        = "CloudEventSchemaV1_0"
}

resource "azurerm_eventgrid_event_subscription" "orders" {
  name                  = "orders-to-queue"
  scope                 = azurerm_eventgrid_topic.orders.id
  event_delivery_schema = "CloudEventSchemaV1_0"
  included_event_types  = ["com.example.order.placed"]

  storage_queue_endpoint {
    storage_account_id = azurerm_storage_account.events.id
    queue_name         = azurerm_storage_queue.orders_placed.name
  }

  retry_policy {
    max_delivery_attempts = 10
    event_time_to_live    = 120
  }

  storage_blob_dead_letter_destination {
    storage_account_id          = azurerm_storage_account.events.id
    storage_blob_container_name = azurerm_storage_container.dead_letters.name
  }
}

# A namespace gives you the MQTT broker and pull delivery. Standard is the tier that has both.
resource "azurerm_eventgrid_namespace" "events" {
  name                = "events-namespace-demo"
  resource_group_name = azurerm_resource_group.events.name
  location            = azurerm_resource_group.events.location
  sku                 = "Standard"
  capacity            = 1
}

output "orders_topic_endpoint" {
  value = azurerm_eventgrid_topic.orders.endpoint
}

# pip install azure-eventgrid azure-identity
# Publishes orders as CloudEvents to an Event Grid namespace topic and reads them back with pull delivery:
# acknowledge what worked, release what should be tried again, reject what can never work.
import os

from azure.core.messaging import CloudEvent
from azure.eventgrid import EventGridConsumerClient, EventGridPublisherClient
from azure.identity import DefaultAzureCredential

ENDPOINT = os.environ["EVENTGRID_NAMESPACE_ENDPOINT"]  # https://<namespace>.<region>-1.eventgrid.azure.net
TOPIC = "orders"
SUBSCRIPTION = "billing"

credential = DefaultAzureCredential()  # needs the EventGrid Data Sender and EventGrid Data Receiver roles
publisher = EventGridPublisherClient(ENDPOINT, credential, namespace_topic=TOPIC)
consumer = EventGridConsumerClient(ENDPOINT, credential, namespace_topic=TOPIC, subscription=SUBSCRIPTION)


def publish(orders):
    """Sends the orders in requests of 100 events, which keeps each request far below the 1 MB limit."""
    for start in range(0, len(orders), 100):
        batch = [CloudEvent(source="/shop/orders", type="com.example.order.placed",
                            subject="orders/%s" % order["orderId"], data=order) for order in orders[start:start + 100]]
        publisher.send(batch)


def drain(handler, rounds=3):
    """Reads up to 50 events at a time. Returns how many were acknowledged, released and rejected."""
    counts = {"acknowledged": 0, "released": 0, "rejected": 0}
    for _ in range(rounds):
        received = consumer.receive(max_events=50, max_wait_time=10)
        if not received:
            break
        done, again, poison = [], [], []
        for item in received:
            token = item.broker_properties.lock_token
            try:
                handler(item.event)
                done.append(token)
            except ValueError:  # the message itself is bad: retrying will never help
                poison.append(token)
            except Exception:  # a dependency was down: let Event Grid hand it out again
                again.append(token)
        if done:
            consumer.acknowledge(lock_tokens=done)
        if again:
            consumer.release(lock_tokens=again)
        if poison:
            consumer.reject(lock_tokens=poison)
        counts["acknowledged"] += len(done)
        counts["released"] += len(again)
        counts["rejected"] += len(poison)
    return counts


def charge(event):
    order = event.data
    if "total" not in order:
        raise ValueError("order has no total")
    print("charging", order["orderId"], order["total"])


if __name__ == "__main__":
    publish([{"orderId": "A-%d" % n, "total": 400 + n * 300} for n in range(1, 6)] + [{"orderId": "A-BAD"}])
    print(drain(charge))

// dotnet add package Azure.Identity
// dotnet add package Azure.ResourceManager.EventGrid
// Audits the subscription: event subscriptions with no dead-letter location, and ones that still retry for the full default.
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.EventGrid;
using Azure.ResourceManager.Resources;

var arm = new ArmClient(new DefaultAzureCredential());
SubscriptionResource subscription = await arm.GetDefaultSubscriptionAsync();
int problems = 0;

await foreach (SystemTopicResource topic in subscription.GetSystemTopicsAsync())
{
    await foreach (SystemTopicEventSubscriptionResource sub in topic.GetSystemTopicEventSubscriptions().GetAllAsync())
    {
        var data = sub.Data;
        if (data.DeadLetterDestination is null)
        {
            Console.WriteLine($"system topic {topic.Data.Name}/{data.Name}: no dead-letter location");
            problems++;
        }
        if (data.RetryPolicy?.EventTimeToLiveInMinutes is null or >= 1440)
        {
            Console.WriteLine($"system topic {topic.Data.Name}/{data.Name}: events are retried for a full day");
            problems++;
        }
    }
}

await foreach (EventGridTopicResource topic in subscription.GetEventGridTopicsAsync())
{
    await foreach (TopicEventSubscriptionResource sub in topic.GetTopicEventSubscriptions().GetAllAsync())
    {
        if (sub.Data.DeadLetterDestination is null)
        {
            Console.WriteLine($"topic {topic.Data.Name}/{sub.Data.Name}: no dead-letter location");
            problems++;
        }
    }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;