Edit

Managed identity authentication for Azure Event Hubs

A managed identity is an identity in Microsoft Entra ID that Azure manages for you, so an application can authenticate to services that support Microsoft Entra authentication without storing any credentials. Azure Event Hubs supports Microsoft Entra authentication with managed identities for Azure resources, which lets applications running in Azure connect to Event Hubs without embedding connection strings or access keys in code or configuration.

When you use a managed identity together with Microsoft Entra authentication, applications running in services such as Azure Virtual Machines, Azure Functions, Azure App Service, and Virtual Machine Scale Sets can access Event Hubs data with credentials that Azure provisions and rotates automatically. This approach removes the risk of leaked keys and reduces the operational overhead of credential management.

For a step-by-step example, see Access Azure Event Hubs from a VM using a managed identity.

How managed identity authentication works

Access to an Event Hubs resource through a managed identity is a two-step process:

  • Authentication: The managed identity requests an OAuth 2.0 token from Microsoft Entra ID. Azure supplies the identity automatically based on the compute environment where the code runs, so no secret is stored or passed in the application.
  • Authorization: The token is presented to the Event Hubs service, which grants access based on the Azure role-based access control (RBAC) roles assigned to the identity.

For a full description of the authentication and authorization flow, see Authorize access to Azure Event Hubs resources using Microsoft Entra ID.

Managed identity types

Event Hubs works with both types of managed identities:

  • System-assigned managed identity: Enabled directly on an Azure resource, such as a virtual machine or an App Service app. Its lifecycle is tied to that resource, and only that resource can use it to request tokens.
  • User-assigned managed identity: Created as a standalone Azure resource and assigned to one or more Azure resources, so multiple workloads can share the same identity.

To learn more about the two types and when to choose each one, see Managed identity types. For the list of services that support managed identities, see Services that support managed identities for Azure resources.

Azure built-in roles for Event Hubs

After you enable a managed identity, assign it an Azure built-in role that defines its permissions on Event Hubs data. Azure provides the following built-in roles for authorizing access to Event Hubs data with Microsoft Entra ID:

Role Description
Azure Event Hubs Data Owner Grants complete access to Event Hubs resources.
Azure Event Hubs Data Sender Grants permission to send events to Event Hubs resources.
Azure Event Hubs Data Receiver Grants permission to receive events from Event Hubs resources.

You can assign a role at the level of a consumer group, event hub, namespace, resource group, or subscription. Grant the narrowest scope that meets the application's needs. For the full list of scopes and role details, see Azure built-in roles for Azure Event Hubs. To assign a role in the Azure portal, see Assign Azure roles using the Azure portal.

Token expiration behavior

When you remove a managed identity from an Event Hubs RBAC role, the change doesn't take effect immediately for a running application. If the source service or app doesn't restart, it can continue to send events to or receive events from the event hub until the token expires. The default token validity is 24 hours. This behavior is by design.

To immediately revoke access after you remove the identity from the role, restart the source app or service so that the existing token expires.

Client SDK support

The Azure SDK client libraries acquire the managed identity token for you through DefaultAzureCredential, which automatically detects the managed identity available in the hosting environment. You pass the credential to EventHubProducerClient to send events and to EventHubConsumerClient to receive events, without providing a connection string or key.

var credential = new DefaultAzureCredential();

// Send events with a managed identity.
var producerClient = new EventHubProducerClient(
    "<namespace>.servicebus.windows.net",
    "<event-hub-name>",
    credential);

// Receive events with a managed identity.
var consumerClient = new EventHubConsumerClient(
    EventHubConsumerClient.DefaultConsumerGroupName,
    "<namespace>.servicebus.windows.net",
    "<event-hub-name>",
    credential);

Install the latest Azure.Messaging.EventHubs package from NuGet to use these clients. For runnable samples, see:

Event Hubs for Apache Kafka

Apache Kafka applications can send events to and receive events from Azure Event Hubs by using managed identity with OAuth. For a Java sample, see Event Hubs for Kafka: send and receive messages using managed identity OAuth.

Related content

  • Last updated on