Edit

Access Azure Event Hubs from a VM by using a managed identity

This article shows you how to connect to Azure Event Hubs from an application that runs on an Azure virtual machine (VM) by using a managed identity. When you use a managed identity, your application authenticates to Event Hubs without storing connection strings or access keys in code or configuration. Azure provisions and rotates the credentials automatically.

In this article, you complete the following tasks:

  • Enable a system-assigned managed identity on a VM.
  • Grant the managed identity permission to send events to an event hub.
  • Create and run a sample application on the VM that uses the managed identity.

To learn how managed identity authentication works with Event Hubs, see Managed identity authentication for Azure Event Hubs.

Prerequisites

Enable a managed identity on the VM

Enable a system-assigned managed identity on the VM. Azure creates an identity in Microsoft Entra ID that's tied to the lifecycle of the VM.

  1. Sign in to the Azure portal.

  2. Go to your virtual machine.

  3. On the VM page, select Security > Identity from the left menu.

  4. On the Identity page, confirm that you're on the System assigned tab.

  5. For the Status field, select On.

  6. Select Save on the command bar, and then select Yes to confirm.

    After Azure creates the identity, the Object (principal) ID appears on the page. You use this identity in the next section.

To enable a user-assigned managed identity instead, see Configure managed identities for Azure resources on a VM. A user-assigned identity is a standalone resource that you can assign to more than one VM.

Grant the managed identity access to Event Hubs

Assign an Azure built-in role to the managed identity so that it can send events to your event hub. This example assigns the Azure Event Hubs Data Sender role at the scope of a single event hub. Grant the narrowest scope that meets your application's needs.

  1. In the Azure portal, go to your event hub.
  2. On the event hub page, select Access control (IAM) from the left menu.
  3. Select Add > Add role assignment.
  4. On the Role tab, select Azure Event Hubs Data Sender, and then select Next.
  5. On the Members tab, for Assign access to, select Managed identity.
  6. Select + Select members, choose the Virtual machine managed identity that you enabled in the previous section, and then select Select.
  7. Select Review + assign to complete the role assignment.

For the full list of roles and scopes, see Azure built-in roles for Azure Event Hubs. To assign roles in the Azure portal, see Assign Azure roles using the Azure portal.

Note

Role assignments can take a few minutes to propagate. If your application can't authenticate immediately, wait and try again.

Create and run the sample application on the VM

Create a .NET console application that sends events to your event hub. When the application runs on the VM, DefaultAzureCredential automatically detects the managed identity, so you don't provide a connection string or key.

  1. Connect to the VM. For a Windows VM, use Remote Desktop. For a Linux VM, use SSH.

  2. In a terminal on the VM, create a project and add the required packages:

    dotnet new console --name EventHubsManagedIdentitySample
cd EventHubsManagedIdentitySample
dotnet add package Azure.Messaging.EventHubs
dotnet add package Azure.Identity

  3. Replace the contents of Program.cs with the following code. Replace <namespace> with your Event Hubs namespace name and <event-hub-name> with your event hub name.

    using Azure.Identity;
using Azure.Messaging.EventHubs;
using Azure.Messaging.EventHubs.Producer;

// DefaultAzureCredential detects the managed identity available on the VM.
var credential = new DefaultAzureCredential();

var producerClient = new EventHubProducerClient(
    "<namespace>.servicebus.windows.net",
    "<event-hub-name>",
    credential);

using EventDataBatch eventBatch = await producerClient.CreateBatchAsync();
eventBatch.TryAdd(new EventData("First event from a managed identity"));
eventBatch.TryAdd(new EventData("Second event from a managed identity"));

await producerClient.SendAsync(eventBatch);
await producerClient.DisposeAsync();

Console.WriteLine("Events sent to the event hub.");

  4. Build and run the application on the VM:

    dotnet run

    The application uses the VM's managed identity to authenticate and sends the events. When the events are sent, the console displays Events sent to the event hub.

  5. To confirm that the events arrived, use the Data Explorer in the Azure portal for your event hub, or the metrics on the namespace Overview page.

Tip

When you use a user-assigned managed identity, or when more than one identity is available on the VM, set the client ID so that DefaultAzureCredential selects the correct identity. For more information, see DefaultAzureCredentialOptions.ManagedIdentityClientId.

Related content

  • Last updated on