How to create a event subscription between event grid in one tenant and service bus in another tenant?

Question

I am developing a service that utilize Azure Event Grid Domain to fanout custom event. The event grid domain is located in PME domain and the event handler is a service bus topic locates in Redmond domain. When created event subscription though Azure CLI, I got the error like this:

The client has permission to perform action 'Microsoft.ServiceBus/namespaces/queues/write' on scope '/subscriptions/*********************/resourceGroups/****/providers/Microsoft.EventGrid/domains/*****/topics/********/providers/Microsoft.EventGrid/eventSubscriptions/*****************', however the current tenant '*************************' is not authorized to access linked subscription '******************************************'

Anyone knows if I can create event subscription for the service bus in another tenant?

Answer 1

@Wen Gao Yes, you can follow the below steps for the cross-tenant subscriptions

• You need to make the REST call that should include two tokens. One token is useful to create an event subscription and the other token is to do an access check on the target destination. You can refer to authenticate multi tenant document for more details.
• You can use CLI code to make the REST call as below snippet. This is only for reference and you can build it according to your requirement.

  eventSubUri = /subscriptions/yoursubscriptionID/resourceGroups/resourcegroupname/providers/Microsoft.EventGrid/systemTopics/yourtopic/providers/Microsoft.EventGrid/eventSubscriptions/yoursubscription?api-version=2020-01-01-preview`  
  
  method=PUT  
  
  primaryToken="Bearer yourprimarytoken"   
  
  auxToken="Bearer auxToken"  
  
  az rest --uri $eventSubUri --method $method --skip-authorization-header --headers Authorization="$primaryToken" x-ms-authorization-auxiliary="$auxToken" ContentType="application/json" --body "{\"properties\":{\"destination\":{\"endpointType\":\"ServiceBusQueue\",\"properties\":{\"resourceId\":\"/subscriptions/yoursubscriptionID/resourceGroups/yourresourcegroupname/providers/Microsoft.ServiceBus/namespaces/yourservicebusnamespacename/queues/yourqueuename\"}},\"eventDeliverySchema\":\"EventGridSchema\"}}"  
  

  You can refer to Az get access token command on how to get the token and az rest command document on how the REST call is created.