Issue Creating Event Grid Webhook Subscription with API Management and System-Assigned Identity

Question

Hello,

I am implementing an Event Grid → API Management → App Service integration using a Webhook Event Grid subscription authenticated via Managed Identity. I have followed the official Microsoft documentation for configuring a webhook endpoint protected with Azure AD authentication (documented here): https://learn.microsoft.com/azure/event-grid/webhook-event-delivery

Architecture

• Event Grid Topic publishes events.
• API Management exposes a backend endpoint protected by Azure AD.
• API Management forwards the request to an App Service.
• The Event Grid subscription is configured to authenticate to the APIM endpoint using system-assigned managed identity.

Issue

I can successfully create the Event Grid subscription only when I configure the Azure AD application ID of Microsoft.EventGrid as the audience / App Registration.

However, if I try to use the application ID of my own Azure AD App Registration (created specifically for APIM authentication), Event Grid fails to acquire a token for that audience. Because of this:

• The subscription cannot be created.
• No calls reach APIM.
• No traces appear in Application Insights.

Expected Behavior

My expectation is that Event Grid, when using system-assigned identity, should be able to request a token for any Azure AD application that I configure as the audience for APIM (as long as Event Grid identity has permission on that app / API).

Observed Behavior

• Using audience = Microsoft.EventGrid (official app) → ✅ Works
• Using audience = my custom Azure AD app registration → ❌ Fails, Event Grid cannot obtain a token

Request

Could you please confirm:

1. Is this the expected behavior? Is Event Grid limited to using the built-in Microsoft.EventGrid application ID when generating tokens for webhook authentication?

If not expected, what configuration might be missing?

• Does the Event Grid system-assigned identity require additional permissions on my custom Azure AD app?
  • Are there restrictions on defining custom audiences for webhook authentication?
    • Are there additional steps needed in the APIM OAuth 2.0 configuration?

Any guidance or clarification will be appreciated. Thank you.

Answer 1

Hi @Lorca , Alberto,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Glad the MS support was able to give you clarity on this, yes, The Document needs to be updated.

Why Microsoft Requires Microsoft.EventGrid as the Audience?

1. Event Grid Is a First‑Party Microsoft Service (Not a Generic Client)

When Event Grid delivers events using Managed Identity, it does not behave like a normal OAuth client.

Instead:

Event Grid uses a Microsoft‑owned, first‑party service principal

Token issuance is restricted at the platform level

The service is only allowed to request tokens for known, pre‑approved resource audiences

One of those explicitly allowed audiences is:

Microsoft.EventGrid

This is enforced internally by Azure and cannot be overridden.