Azure Event Grid
An Azure event routing service designed for high availability, consistent performance, and dynamic scale.
441 questions
Azure Event Grid - storage account event handled by Azure Function
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 64%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIC%3C/text%3E%3C/svg%3E)
Ian Carrick (csu)
5
Reputation points
I am new to Azure Event Grid. I understand the publisher and subscriber model.
I have an Azure storage account that has public access disabled and is linked to a VNet/subnet via private-end-point. When a new blob is created I want an event to fire and be handled by an Azure function (within a function app).
The function has both a private-end-point for ingress traffic and VNet integration for outbound traffic. All the subnets mentioned are in the same VNet. The subnets have nsgs.
How do i go about doing this?
Azure Event Grid
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 5%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Praveen Kumar Gudipudi 350 Reputation points Microsoft External Staff Moderator2025-05-06T19:37:24.3933333+00:00 To securely trigger an Azure Function when a new blob is created in a storage account with public access disabled and linked to a VNet via private endpoint, follow these steps:
- Configure Azure Storage Account with Private Endpoint
Private Endpoint: Ensure your Azure Storage Account has a private endpoint configured within your VNet. This setup ensures that the storage account is accessible only within your private network.
Disable Public Access: Confirm that public access to the storage account is disabled to prevent any external access.
DNS Configuration: Configure DNS settings to resolve the storage account's private endpoint correctly within your VNet. This may involve setting up a private DNS zone and linking it to your VNet.
- Set Up Azure Function with VNet Integration
VNet Integration: Deploy your Azure Function App with VNet integration enabled. This allows the function to access resources within your VNet securely.
Private Endpoint for Ingress: Configure a private endpoint for your Function App to handle ingress traffic securely within the VNet.
DNS Configuration: Ensure that the DNS settings for your Function App resolve correctly within your VNet. This may involve setting the
WEBSITE_DNS_SERVERapplication setting to168.63.129.16and enablingWEBSITE_VNET_ROUTE_ALL.Microsoft Tech Community- Implement Event Handling with Event Grid
Event Grid Subscription: Create an Event Grid subscription to listen for blob creation events in your storage account.
Event Delivery Method: Since Event Grid does not support private endpoint delivery for push events, configure the event subscription to use a secure delivery method, such as an Event Hub or Service Bus, which can then trigger your Azure Function.Microsoft Learn+1Microsoft Tech Community+1
Managed Identity: Use a managed identity for secure communication between Event Grid and your event handler (Event Hub or Service Bus).Microsoft Tech Community+1Microsoft Learn+1
- Configure Intermediate Component (Event Hub or Service Bus)
Event Hub or Service Bus: Set up an Event Hub or Service Bus within your VNet to receive events from Event Grid.
Private Endpoint: Configure a private endpoint for the Event Hub or Service Bus to ensure that traffic remains within the VNet.
Event Subscription: Create an event subscription from Event Grid to the Event Hub or Service Bus using the managed identity for secure delivery.Microsoft Tech Community
- Trigger Azure Function from Event Hub or Service Bus
Function Trigger: Configure your Azure Function to be triggered by messages from the Event Hub or Service Bus.Microsoft Tech Community+1Microsoft Learn+1
Private Endpoint: Ensure that the Azure Function App has a private endpoint configured to handle ingress traffic securely within the VNet.
DNS Configuration: Verify that the DNS settings for your Azure Function resolve correctly within your VNet to the private endpoint.
- Testing and Validation
Upload Blob: Upload a new blob to your storage account to trigger the event.
Monitor Function Execution: Check the logs and monitoring tools to verify that the Azure Function is triggered and processes the event as expected.
- Troubleshooting: If the function is not triggered, review the Event Grid subscription settings, managed identity permissions, and network configurations to identify and resolve any issues.To securely trigger an Azure Function when a new blob is created in a storage account with public access disabled and linked to a VNet via private endpoint, follow these steps: By following these steps, you can securely trigger an Azure Function in response to blob creation events in a storage account with private access configurations.
-
Sander van de Velde | MVP 36,326 Reputation points MVP Moderator2025-05-07T07:19:17.7633333+00:00 Hello Ian Carrick (csu),
welcome to this moderated Azure community forum.
You want to put an Event Grid and Topic between a blob storage and a Azure Function.
To simplify the architecture, have you considered connecting the Azure Function directly to the the blob storage via a blob trigger, without the Event Grid?
-
Ian Carrick (csu) 5 Reputation points
2025-05-07T07:32:40.07+00:00 Thank you for the answers; Praveen Kumar Gudipudi and Sander van de Velde
I am going be working through both solutions with the function-app developers...
Watch this space.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 30%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMO%3C/text%3E%3C/svg%3E)
Michael O'Sullivan 5 Reputation points2025-05-07T12:06:39.8133333+00:00 Hi @Sander van de Velde | MVP ,
Thanks for your response. The reason we haven't gone the Blob Trigger route is because we are polling the whole storage account, not just a known container. We initially tried using the EventGridTrigger with our Event Subscription configured to use an Azure Function endpoint, but we got a AZFW0001 as we are using .NET 9 and the isolated process worker model is not supported.
We are currently using a HttpTrigger on our Function, to which the Event Subscription is connected via Webhook endpoint type. We have function level authorization on the Function. This is working in Dev but the issues arise around deployment and security as Ian has mentioned above.
-
Praveen Kumar Gudipudi 350 Reputation points Microsoft External Staff Moderator
2025-05-08T16:22:53.86+00:00 Hello Ian Carrick (csu),
Have you had a chance to implement the suggested solution? If so, please provide us with an update.
-
Ian Carrick (csu) 5 Reputation points
2025-05-09T06:21:53.9433333+00:00 No solution implemented yet.
We have a meeting scheduled for Monday between the developers and devops engineers to discuss. Will update this ticket afterwards.
-
Praveen Kumar Gudipudi 350 Reputation points Microsoft External Staff Moderator
2025-05-12T16:22:20.8966667+00:00 -
Ian Carrick (csu) 5 Reputation points
2025-05-12T16:33:12.4266667+00:00 Sorry no update as the meeting with the developers was cancelled. Will update this thread as soon as possible.
Sign in to comment
Sign in to answer