Use identity-based authentication for Event Hub namespaces

March 21, 2025 · View on GitHub

SYNOPSIS

Authenticate Event Hub publishers and consumers with Entra ID identities.

To publish or consume events from Event Hubs cryptographic keys, or Entra ID (previously Azure AD) identities can be used. Cryptographic keys include Shared Access Policy keys or Shared Access Signature (SAS) tokens. With Entra ID authentication, the identity is validated against Azure AD. Using Entra ID identities centralizes identity management and auditing.

Once you decide to use Entra ID authentication, you can disable authentication using keys or SAS tokens.

RECOMMENDATION

Consider only using Entra ID identities to publish or consume events from Event Hub. Then disable authentication based on access keys or SAS tokens.

EXAMPLES

Configure with Azure template

To deploy Event Hub namespaces that pass this rule:

Set the properties.disableLocalAuth property to true.

For example:

{
  "type": "Microsoft.EventHub/namespaces",
  "apiVersion": "2024-01-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "sku": {
    "name": "Standard"
  },
  "properties": {
    "disableLocalAuth": true,
    "minimumTlsVersion": "1.2",
    "publicNetworkAccess": "Disabled",
    "isAutoInflateEnabled": true,
    "maximumThroughputUnits": 10,
    "zoneRedundant": true
  }
}

Configure with Bicep

To deploy Event Hub namespaces that pass this rule:

Set the properties.disableLocalAuth property to true.

For example:

resource ns 'Microsoft.EventHub/namespaces@2024-01-01' = {
  name: name
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  sku: {
    name: 'Standard'
  }
  properties: {
    disableLocalAuth: true
    minimumTlsVersion: '1.2'
    publicNetworkAccess: 'Disabled'
    isAutoInflateEnabled: true
    maximumThroughputUnits: 10
    zoneRedundant: true
  }
}

Configure with Azure Policy

To address this issue at runtime use the following policies: