Connecting Microsoft Graph Subscriptions to Azure Event Hub facing time out issues starting today

Question

Connecting Microsoft Graph Subscriptions to Azure Event Hub facing time out issues starting today

Oak, Ryan 5

I am working on a project that passes Graph events through an Azure Event Hub to trigger a function app. The subscriptions had been set up and running for months without issue. Two days ago, I switched my functions over to the isolated model as opposed to the in process model. Before this switch over, subscriptions to Graph with the Event Hub passed into it as notificationUrl in the form below was working.

EventHub:https://{eventHubNamespace}.servicebus.windows.net/eventhubname/{eventHubName}?tenantId={tenantId}

While swapping the function apps over, I received a notification there was an issue with Host ID overlaps. After resolving this error, I went to add a new subscription to Graph before I received this error, which I had not encountered to this point:

{
    "error": {
        "code": "ValidationError",
        "message": "Subscription validation request timed out.",
        "innerError": {
            "date": "2025-06-20T20:35:36",
            "request-id": "xxxxxxx",
            "client-request-id": "xxxxxxx"
        }
    }
}

I attempted to resolve this issue by adding a new event hub to the same event hub namespace I had been using, but that did not solve the time out issue. I have also created a new namespace, and tried with the event hub in my other resource group.

The event hubs are still actively processing current Graph Subscription notifications, but my re-subscribe function that maintains these subscriptions is obviously failing with the same issue. It isn't a problem with the bearer token either, as I am using the same method as always. The only other change I can think of that would impact this would be some sort of throttling but there are less than a hundred active subscriptions to graph and less than a few thousand events every day. There are currently as of posting time no listed outages for Azure, but I did find that earlier this month there were some Azure outages reported. I am within a tenant set up in West US, all resources are set up in West US, and I am using an app registration for authentication into Azure. These requests were made both through C# code and through Postman, and attempted on multiple machines, all with the same response of "timing out". My event hubs are enabled and active, showing no errors or raising no warnings. Any help would be great. Thanks.

Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-21T00:23:59.3266667+00:00
@Oak, Ryan

Thanks for the detailed explanation, it really helps in narrowing down the issue.

Based on what you've shared, it appears the root cause of the timeout error when creating new Microsoft Graph subscriptions is the use of an Azure Event Hub as the notificationUrl. While this may have appeared to work previously, Event Hub does not support the subscription validation handshake required by Microsoft Graph.

Why it's failing now:

When a subscription is created, Microsoft Graph sends a validationToken request to the notificationUrl, expecting an immediate 200 OK response with the token in plain text. Event Hubs are not designed to receive or respond to HTTP requests, and therefore will always timeout during this validation step. This behavior aligns with the error you're seeing: "message": "Subscription validation request timed out."

Even though existing subscriptions might still be processing events via Event Hub, new subscriptions will always fail at creation unless the endpoint supports the required validation.

Recommended Solution

To resolve this - Use an Azure Function App (HTTP-triggered) or another Web API endpoint as the notificationUrl. In that function:

Handle the validationToken by immediately returning it as plain text.

Once validated, forward the actual Graph change notifications to your Event Hub.

Here’s a basic C# example for your Azure Function:

[Function("GraphListener")] public async Task<HttpResponseData> Run( [HttpTrigger(AuthorizationLevel.Function, "post", Route = null)] HttpRequestData req, FunctionContext context) { string requestBody = await new StreamReader(req.Body).ReadToEndAsync(); var json = JsonDocument.Parse(requestBody); if (json.RootElement.TryGetProperty("validationToken", out var token)) { var response = req.CreateResponse(HttpStatusCode.OK); response.Headers.Add("Content-Type", "text/plain"); await response.WriteStringAsync(token.GetString()); return response; } // Optionally: forward the notification to Event Hub here return req.CreateResponse(HttpStatusCode.Accepted); }

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Oak, Ryan 5 Reputation points

2025-06-23T04:08:47.5933333+00:00

@Chandra Boorla Is this a recent change? As recently as 6/17 I was able to submit the Azure Event Hub as the notification endpoint for Graph. I can definitely adapt the solution to accept this change, but I would like some clarification if you have any. Would life some clarification to explain to my bosses. Your answer is very helpful though!
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-23T18:53:09.82+00:00
@Oak, Ryan

Thank you so much for your follow-up, and I truly appreciate your patience.

I want to sincerely apologize for the confusion in my earlier response. I previously mentioned that Azure Event Hub cannot be used as a notificationUrl for Microsoft Graph due to validation requirements, but that was incorrect in the context of your setup.

Corrected Guidance Based on Microsoft Documentation

Microsoft Graph does support delivering change notifications directly to Azure Event Hub using the special URI format:

EventHub:https://<namespace>.servicebus.windows.net/<eventhub-name>?tenantId=<tenant-id>

When using this format, Microsoft Graph does not perform a validationToken handshake. This is clearly stated in Microsoft's documentation, and your existing integration approach is fully supported.

Why you might be seeing the Timeout

Since Graph skips the validation step for Event Hub endpoints, the "Subscription validation request timed out" error is likely due to one of the following:

RBAC permissions - Make sure the app registration used to create the subscription has Azure Event Hubs Data Sender and Reader roles on the Event Hub namespace.

Firewall or VNet restrictions - If the Event Hub is behind a firewall or in a VNet, ensure “Allow trusted Microsoft services to bypass this firewall” is enabled.

Tenant ID mismatch - Double-check that the tenantId in the URI matches the tenant used in your authentication token.

No need to use Azure Function

You do not need to use an Azure Function or Webhook to perform validation in this case, your current approach using Event Hub as the direct target remains valid and supported.

I hope this information helps.

Thank you.
Oak, Ryan 5 Reputation points

2025-06-23T18:55:07.97+00:00

I was able to solve this problem a few minutes ago! It had to do with the handling of the lifecycleNotificationUrl, not the notificationUrl. Thanks for the help!
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-24T18:57:30.6866667+00:00

@Oak, Ryan

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

1 answer

Your answer

Oak, Ryan 5 Reputation points

2025-06-23T04:08:47.5933333+00:00

@Chandra Boorla Is this a recent change? As recently as 6/17 I was able to submit the Azure Event Hub as the notification endpoint for Graph. I can definitely adapt the solution to accept this change, but I would like some clarification if you have any. Would life some clarification to explain to my bosses. Your answer is very helpful though!
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-23T18:53:09.82+00:00

@Oak, Ryan

Thank you so much for your follow-up, and I truly appreciate your patience.

I want to sincerely apologize for the confusion in my earlier response. I previously mentioned that Azure Event Hub cannot be used as a notificationUrl for Microsoft Graph due to validation requirements, but that was incorrect in the context of your setup.

Corrected Guidance Based on Microsoft Documentation

Microsoft Graph does support delivering change notifications directly to Azure Event Hub using the special URI format:

EventHub:https://<namespace>.servicebus.windows.net/<eventhub-name>?tenantId=<tenant-id>

When using this format, Microsoft Graph does not perform a validationToken handshake. This is clearly stated in Microsoft's documentation, and your existing integration approach is fully supported.

Why you might be seeing the Timeout

Since Graph skips the validation step for Event Hub endpoints, the "Subscription validation request timed out" error is likely due to one of the following:

RBAC permissions - Make sure the app registration used to create the subscription has Azure Event Hubs Data Sender and Reader roles on the Event Hub namespace.

Firewall or VNet restrictions - If the Event Hub is behind a firewall or in a VNet, ensure “Allow trusted Microsoft services to bypass this firewall” is enabled.

Tenant ID mismatch - Double-check that the tenantId in the URI matches the tenant used in your authentication token.

No need to use Azure Function

You do not need to use an Azure Function or Webhook to perform validation in this case, your current approach using Event Hub as the direct target remains valid and supported.

I hope this information helps.

Thank you.
Oak, Ryan 5 Reputation points

2025-06-23T18:55:07.97+00:00

I was able to solve this problem a few minutes ago! It had to do with the handling of the lifecycleNotificationUrl, not the notificationUrl. Thanks for the help!
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-24T18:57:30.6866667+00:00

@Oak, Ryan

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Answer 1

@Oak, Ryan

That’s excellent news, I’m really glad to hear you were able to get it working!

Thank you for sharing the root cause as well.

You're absolutely right - when using a lifecycleNotificationUrl in the subscription payload, it must be a reachable HTTPS endpoint that can properly handle lifecycle notifications (such as missed or reauthorizationRequired) and respond with an HTTP 200.

It’s a subtle but important distinction and definitely something that can lead to confusion since the notificationUrl (Event Hub in your case) was correctly configured the entire time.

Reference Microsoft documentation: Reduce missing subscriptions and change notifications

Thanks again for closing the loop. Your troubleshooting and clarification will no doubt help others facing similar issues, please do click Accept Answer and Yes if the above information helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

User's image

Share via

Connecting Microsoft Graph Subscriptions to Azure Event Hub facing time out issues starting today

1 answer

Your answer