Event Grid cross-tenant delivery using Managed Identity fails with “Internal error” when creating Event Subscription

Question

Event Grid cross-tenant delivery using Managed Identity fails with “Internal error” when creating Event Subscription

EliT 0

Hi,

I’m implementing cross-tenant Event Grid delivery using Managed Identity, following this official Microsoft doc:

https://learn.microsoft.com/azure/event-grid/cross-tenant-delivery-using-managed-identity

I have two tenants:

Customer tenant (Tenant A)

Contains the Storage Account
Has the Event Grid system topic
Created a user-assigned managed identity (UAMI) and assigned it to the system topic
Trying to create a cross-tenant event subscription

Vega (SaaS) tenant (Tenant B) Contains a Service Bus namespace + queue

  Contains a **multi-tenant application** with a **Federated Identity Credential (FIC)**

        Issuer = Customer tenant

              Subject = clientId of the UAMI

                    Audience = `api://AzureADTokenExchange`

                       The Vega app’s service principal has **Azure Service Bus Data Sender** role on the queue

This matches the steps described in the documentation exactly.

Problem

When I try to create the Event Grid subscription in the customer tenant using cross-tenant delivery:

Endpoint type: Service Bus Queue

Cross-tenant delivery: Enabled

Managed identity type: User Assigned

Managed identity: the UAMI assigned to the system topic

Federated identity credentials (multitenant application ID): the Vega appId

The deployment fails immediately with:

Deployment has failed with the following error:
{"code":"Internal error","message":"The operation failed due to an internal server error. 
The initial state of the impacted resources (if any) are restored. 
Please try again in few minutes. If error still persists, report 
12471e63-0fca-4eec-bc39-6d75375764cb:11/27/2025 8:59:39 AM (UTC) 
to our forums for assistance or raise a support ticket ."}

There are no additional details in Activity Log.

Operation ID shown in the error:

12471e63-0fca-4eec-bc39-6d75375764cb Timestamp: 2025-11-27 08:59:39 UTCHi,

I’m implementing cross-tenant Event Grid delivery using Managed Identity, following this official Microsoft doc:

https://learn.microsoft.com/azure/event-grid/cross-tenant-delivery-using-managed-identity

I have two tenants:

Customer tenant (Tenant A)

Contains the Storage Account

  Has the **Event Grid system topic**
  
     Created a **user-assigned managed identity (UAMI)** and assigned it to the system topic
     
        Trying to create a cross-tenant event subscription
        
        **Vega (SaaS) tenant** (Tenant B)
        
           Contains a **Service Bus namespace + queue**
           
              Contains a **multi-tenant application** with a **Federated Identity Credential (FIC)**
              
                    Issuer = Customer tenant
                    
                          Subject = clientId of the UAMI
                          
                                Audience = `api://AzureADTokenExchange`
                                
                                   The Vega app’s service principal has **Azure Service Bus Data Sender** role on the queue

This matches the steps described in the documentation exactly.

Problem

When I try to create the Event Grid subscription in the customer tenant using cross-tenant delivery:

Endpoint type: Service Bus Queue

Cross-tenant delivery: Enabled

Managed identity type: User Assigned

Managed identity: the UAMI assigned to the system topic

Federated identity credentials (multitenant application ID): the Vega appId

The deployment fails immediately with:

Deployment has failed with the following error:
{

There are no additional details in Activity Log.

Operation ID shown in the error:

12471e63-0fca-4eec-bc39-6d75375764cb
Timestamp: 2025-11-27 08:59:39 UTC

Siddhesh Desai 7,055 Reputation points Microsoft External Staff Moderator

2025-11-27T11:37:35.4766667+00:00

Hi

Thank you for reaching out to Microsoft Q&A

Can you check if you have added your multi-tenant app the appropriate role so that the app can send events to the storage account. For example: Storage Account Contributor, Storage Queue Data Contributor, Storage Queue Data Message Sender.

And also check the following:

Tick the Cross Tenant Delivery checkmark and also add the Endpoint to the Target Tenant's Subscription Id, Resource Group, Storage Account Name, Queue Name.
EliT 0 Reputation points

2025-11-27T11:43:45.4566667+00:00

Hi, thanks for your response,
Yes, the multi-tenant app exists on the dest account - where the service bus is
and have data sender on the described service bus
Iv'e tick the multi-tenant and used the multi-tenant app id
Also Ive added federated credentials to the multi-tenant app with the second tenant as issuer
and the event grid user identity as client id - all as on the docs iv'e provided which Ive followed
Siddhesh Desai 7,055 Reputation points Microsoft External Staff Moderator

2025-11-27T11:50:49.2733333+00:00

Hi,

I have messaged you in a Private Conversation, Let's have a discussion there.

1 answer

Your answer

Siddhesh Desai 7,055 Reputation points Microsoft External Staff Moderator

2025-11-27T11:37:35.4766667+00:00

Hi

Thank you for reaching out to Microsoft Q&A

Can you check if you have added your multi-tenant app the appropriate role so that the app can send events to the storage account. For example: Storage Account Contributor, Storage Queue Data Contributor, Storage Queue Data Message Sender.

And also check the following:

Tick the Cross Tenant Delivery checkmark and also add the Endpoint to the Target Tenant's Subscription Id, Resource Group, Storage Account Name, Queue Name.
EliT 0 Reputation points

2025-11-27T11:43:45.4566667+00:00

Hi, thanks for your response,
Yes, the multi-tenant app exists on the dest account - where the service bus is
and have data sender on the described service bus
Iv'e tick the multi-tenant and used the multi-tenant app id
Also Ive added federated credentials to the multi-tenant app with the second tenant as issuer
and the event grid user identity as client id - all as on the docs iv'e provided which Ive followed
Siddhesh Desai 7,055 Reputation points Microsoft External Staff Moderator

2025-11-27T11:50:49.2733333+00:00

Hi,

I have messaged you in a Private Conversation, Let's have a discussion there.

Answer 1

Hi @EliT

Thank you for reaching out to Microsoft Q&A

Event Grid requires a SessionId when delivering to a session‑enabled queue otherwise, the portal/ARM call often surfaces only “Internal error”. Either disable sessions on the queue or add a Delivery Property for SessionId in the event subscription creation portal - Delivery properties - add SessionId with a static value ARM/CLI - delivery properties block.

Assign Azure Service Bus Data Sender at the namespace scope as well, you can keep the queue‑level assignment just add namespace‑level

az role assignment create \
  --assignee <xxxxxxx> \
  --role "Azure Service Bus Data Sender" \
  --scope /subscriptions/<xxxxx>/resourceGroups/<xxxx>/providers/Microsoft.ServiceBus/namespaces/<xxxxx>

Your namespace shows defaultAction: Allow and trustedServiceAccessEnabled: false. With Allow, the “trusted services” bypass isn’t required.

Toggle trusted services bypass to true (even though Allow) and re‑apply:

az servicebus namespace network-rule-set update \
  --resource-group xxxxxxxx \
  --namespace-name xxxxxxxxx \
  --trusted-service-access-enabled true

Your issuer and subject UAMI clientId look right. If the enterprise app (Vega) wasn’t properly consented or if there’s a stale SP, the exchange can fail without a clear portal error.

Re‑generate the FIC delete & recreate to rule out hidden characters.

In Tenant B, check Entra sign‑in logs filtered to the Vega app at the timestamp of the creation attempt you should see token exchange entries. Any aud/iss/sub mismatch will be explicit there.

Confirm the Vega app is multi‑tenant, and the Service Principal exists in Tenant B, you already have the SP id from the role assignment.

You can fetch the internal error from your Operation ID, by using the Rest API below:

# Replace with Tenant A subscription where you ran the create
az rest --method get \
  --url "https://management.azure.com/subscriptions/xxxxx/providers/Microsoft.EventGrid/operationsStatus/xxxxxxxxxb?api-version=2022-06-15"

You can recreate the subscription using azure cli again:

# IDs
SB_QUEUE_ID="/subscriptions/xxxxx/resourceGroups/xxxxxx/providers/Microsoft.ServiceBus/namespaces/xxxxxx/queues/xxxxx"
UAMI_ID="/subscriptions/xxxxx/resourceGroups/xxxxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/xxxxx"
SYSTEM_TOPIC_ID="/subscriptions/xxxx/resourceGroups/xxxxx/providers/Microsoft.EventGrid/systemTopics/xxxxxx"
Client_Id="xxxxxxx"
# If your queue uses sessions, set a SessionId delivery property
SESSION_ID="xxxxxx"   # choose any static string
# Create the subscription
az eventgrid event-subscription create \
  --name xxxxx \
  --source-resource-id "xxxxxx" \
  --endpoint-type servicebusqueue \
  --endpoint "xxxxxx" \
  --delivery-identity userassigned \
  --delivery-identity-resource-id "xxxx \
  --delivery-identity-endpoint-type servicebusqueue \
  --delivery-identity-federated-credential-application-id "xxxxxx" \
  --delivery-properties "key=SessionId value=xxxxxx"   # <-- add only if queue has sessions

Ensure the DL Storage grants the delivery identity Storage Blob Data Contributor. Missing DL permissions cause creation errors.

Share via

Event Grid cross-tenant delivery using Managed Identity fails with “Internal error” when creating Event Subscription

Problem

Problem

1 answer

Your answer