Azure EventGrid Event Dropping

Question

I have an azure event that is triggered when a blob is created in a storage account to call a function app. This had been working for a while before before but suddenly stopped without making any changes to the event subscription. When I check the metrics it appears that the events are being dropped and the function app is never being invoked.

Checking the deadletter reason i see ""deadLetterReason":"UndeliverableDueToClientError","deliveryAttempts":1,"lastDeliveryOutcome":"Probation""

Any guidance why this suddenly would stop working would be greatly appreciated thank you.

Answer 1

Hi @Dustin Chavez ,

Thanks for the confirmation, glad the issue is resolved.

This issue is solved by allowing the event grid access to the function app.

The “UndeliverableDueToClientError” with only 1 delivery attempt almost always means Event Grid saw a 400 or 413 and gave up right away.

Here’s how you can troubleshoot and remediate:

1. Verify your Function endpoint & auth

• Make sure the Function URL you configured in the event subscription is still correct.
• If you’re using a function key, double-check it hasn’t expired or been rotated.
• If you’ve recently enabled App Service Authentication (Easy Auth) or IP restrictions, confirm Event Grid is allowed through.

2. Check Function App logs

• Look in Application Insights or your Function’s Log stream for any incoming requests or errors. If you see no hits at all, Event Grid isn’t even reaching your function.
• If you do see requests, note the HTTP status code returned—Event Grid dead-letters on 400 or 413 immediately.

3. Enable Event Grid diagnostics & metrics

• Turn on diagnostic logging for your Event Grid topic/subscription to capture request/response details: https://docs.microsoft.com/azure/event-grid/enable-diagnostic-logs-topic
• View delivery metrics and see what status codes are coming back: https://docs.microsoft.com/azure/event-grid/monitor-event-delivery

4. Test your subscription endpoint

• In the Azure Portal, open your Event Subscription and click “Test” to send a sample event. Observe the response code.
• You can also curl or Postman the Function URL directly (including the key) to ensure it returns HTTP 2xx.

5. Review networking & private endpoints

• If your Function App is in a VNet or you’ve locked down outbound calls, make sure Event Grid’s IP ranges are allowed.
• If you moved your storage account behind firewall/private endpoint, ensure the Event Grid service can still publish to it.

6. Redeploy/Re-create subscription (if necessary)

• Sometimes updating the endpoint URL or regenerating a key and then saving the event subscription refreshes its handshake. If you suspect the subscription is corrupted, recreate it from scratch.

Hope this helps!

---

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

The dead-letter metadata shows a client error and lastDeliveryOutcome of Probation. In Event Grid, probation means deliveries to the destination have started failing and Event Grid temporarily stops attempting delivery, potentially dead-lettering or dropping events without further attempts.

From the documented outcomes and probation behavior:

• UndeliverableDueToClientError indicates the destination (the Function App endpoint) is returning a client-side failure (for example, 4xx HTTP status) so Event Grid determines the event cannot be delivered successfully.
• lastDeliveryOutcome":"Probation" means Event Grid has put the event subscription into a probation period because of repeated failures from the destination.
• While in probation, events can be dead-lettered or dropped without another delivery attempt, depending on the error that caused probation.

Event Grid uses specific probation durations depending on the error condition (for example, Unauthorized, Forbidden, NotFound, TimedOut, etc.). During these periods, Event Grid does not attempt delivery and events may go straight to dead-letter or be dropped.

Given this, the sudden stop in Function App invocations is explained by:

1. The Function App endpoint started returning a client error (for example, 400/401/403/404 or similar), so Event Grid treated the events as undeliverable.
2. Event Grid then placed the subscription into probation (lastDeliveryOutcome":"Probation").
3. While in probation, events are dead-lettered or dropped without further attempts, so the Function App is no longer invoked.

To restore delivery, the client error from the Function App endpoint must be resolved so that it returns one of the success codes (200–204). Once the destination starts responding successfully again, Event Grid will resume normal delivery outside of probation.

---

References:

• Event Grid message delivery and retry
• Message push delivery and retry with namespace topics
• Dead lettering for event subscriptions to namespaces topics in Azure Event Grid