Event Grid System Topic security

Question

Event Grid System Topic security

Syed, Umair 45

I want to understand how event grid system topic is made secured from external traffic on a network level? Is it secured using Azure backbone or managed Vnet integration so external traffic can not post events to it and only it is accessible to Azure resources?

Publishing an event - when we create a blob based trigger in the Data Factory pipeline, this trigger automatically creates a system topic subscription in the event grid. My question is that how can we ensure that only a specific Data Factory instance has access to this system topic at a network level? I realise that subscription will be secured using SAD token, but at a network level, will this system topic still be 'visible' to other resources?
I noticed in the Azure portal that the system topic also has a webhook. Do we need to secure the webhook using IP filtering or RBAC? We already have RBAC on resource group level which restricts the access to only specific users. But for this scenario, do we need to create app registration in Entra Id for ADF and give it access to specific system topic? in other words, do we need to apply RBAC on a topic level if it is a system topic only and is created by ADF automatically when a trigger is created in the pipeline?

I have read the following doc but it does not answer my concerns clearly

https://learn.microsoft.com/en-us/azure/data-factory/how-to-create-event-trigger?tabs=data-factory#role-based-access-control

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T14:57:56.68+00:00

You’re asking whether an Event Grid system topic can be publicly published to and limited to one Data Factory. A system topic represents events emitted by its associated Azure resource; customers do not receive a publishing endpoint or access keys. External clients therefore cannot inject events, and private endpoints or IP firewalls are unavailable for system topics. Use Azure RBAC on the source resource and system topic to limit who can create, update, or delete event subscriptions. Data Factory’s event trigger creates an Event Grid subscription; it does not need an app registration to publish the resource event. Secure the delivery destination separately: use HTTPS validation, Microsoft Entra-authenticated webhook delivery where supported, or a managed-identity destination such as Service Bus, Event Hubs, or Functions with least-privilege RBAC. Restrict and monitor the handler, because destination authorization—not publisher filtering—is the relevant control.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T14:57:56.68+00:00

You’re asking whether an Event Grid system topic can be publicly published to and limited to one Data Factory. A system topic represents events emitted by its associated Azure resource; customers do not receive a publishing endpoint or access keys. External clients therefore cannot inject events, and private endpoints or IP firewalls are unavailable for system topics. Use Azure RBAC on the source resource and system topic to limit who can create, update, or delete event subscriptions. Data Factory’s event trigger creates an Event Grid subscription; it does not need an app registration to publish the resource event. Secure the delivery destination separately: use HTTPS validation, Microsoft Entra-authenticated webhook delivery where supported, or a managed-identity destination such as Service Bus, Event Hubs, or Functions with least-privilege RBAC. Restrict and monitor the handler, because destination authorization—not publisher filtering—is the relevant control.