What is the expected data plane read/write behavior on a secondary namespace when using RBAC authentication?

Question

I have two Event Hubs namespaces configured as a geo-recovery pair. While the pairing is active, any data plane read/write operations sent directly to the secondary namespace using shared access keys for authentication are rejected by EH, effectively making the secondary namespace strictly passive until manual failover. However, using RBAC authentication, clients are able to read and write messages to the secondary namespace regardless of the state of the geo-recovery pairing.

What is the expected data plane read/write behavior on a secondary namespace when using RBAC authentication?

Answer 1

Hi Giovanni Ortiz,

Product team confirmed that they have identified a bug with the behavior you have noticed and working on fixing it. I do not have a definite ETA at this point but will keep you posted as I get more updates on the fix.

Expected behavior: Excepted behavior is that regardless of the auth type, secondary namespace should always block any request other than the GET.

Appreciate much for reporting this issue here and helping improve Azure products.