Event Grid Domains and Topics

Event Grid is Azure's fully managed event routing service that uses a publish-subscribe model. A topic is an endpoint where publishers send events. Event Grid supports three types of topics: system topics (Azure service events), custom topics (user-defined), and partner topics (third-party SaaS). An Event Grid Domain is a management construct that groups multiple topics (called domain topics) under a single endpoint. The domain provides a shared publishing endpoint (e.g., https://mydomain.westus-1.eventgrid.azure.net/api/events) and allows you to manage authorization, authentication, and routing for all topics within it. This is especially useful for multi-tenant applications where each tenant gets its own topic, but you want a single place to manage event ingress and security.

Without domains, each custom topic gets its own endpoint. For a multi-tenant app with 1,000 tenants, you'd need 1,000 separate endpoints, each with its own keys or tokens. This becomes unmanageable. Domains solve this by providing a single endpoint for all tenants. The publisher includes a topic field in each event to specify which domain topic the event belongs to. The domain then routes the event to the correct topic and subsequently to subscribers of that topic. This drastically simplifies client configuration and centralizes security.

[
  {
    "topic": "orders",
    "subject": "new-order/123",
    "eventType": "order.created",
    "eventTime": "2025-03-15T10:00:00Z",
    "id": "guid",
    "data": { ... }
  }
]

To create a domain using Azure CLI:

az eventgrid domain create \
  --name mydomain \
  --resource-group myrg \
  --location westus \
  --input-schema eventgridschema \
  --sku Basic

To add a domain topic:

az eventgrid domain topic create \
  --domain-name mydomain \
  --name orders \
  --resource-group myrg

To subscribe to a domain topic:

az eventgrid event-subscription create \
  --source-resource-id /subscriptions/.../resourceGroups/.../providers/Microsoft.EventGrid/domains/mydomain/topics/orders \
  --name orders-sub \
  --endpoint https://myfunction.azurewebsites.net/api/orders \
  --endpoint-type webhook

To publish an event to the domain:

az eventgrid domain topic event publish \
  --domain-name mydomain \
  --topic-name orders \
  --resource-group myrg \
  --events '[{"topic":"orders","subject":"new-order/123","eventType":"order.created","eventTime":"2025-03-15T10:00:00Z","id":"guid","data":{"orderId":"123"}}]'

Verification: Check the subscription's delivery status via Azure Monitor metrics like MatchedEventCount, DeliverySuccessCount, and DeadLetteredCount.

By default, the domain SAS key allows publishing to any topic within the domain. To restrict, you can generate a SAS key per topic:

az eventgrid domain topic key regenerate \
  --domain-name mydomain \
  --topic-name orders \
  --resource-group myrg \
  --key-name key1

Then provide that key to the tenant. The domain will validate that the key matches the topic. This is crucial for multi-tenant isolation.

A SaaS company provides an e-commerce platform to hundreds of retailers. Each retailer is a tenant. The platform emits events like order.created, payment.processed, and shipment.tracked. Using Event Grid Domains, they create one domain topic per tenant (e.g., 'retailer-123', 'retailer-456'). The domain endpoint is used by all tenant services. Each tenant's backend service subscribes to its own topic. Authentication: each tenant receives a SAS key scoped to their topic. This ensures Tenant A cannot publish to Tenant B's topic. In production, the domain handles 10,000 events/second across 2,000 topics. They monitor delivery failures via Azure Monitor and dead-letter storage for troubleshooting. Misconfiguration: If the SAS key is not scoped per topic, a compromised key could allow cross-tenant publishing. Solution: always generate per-topic keys.

A large enterprise uses microservices that need to communicate asynchronously. They create an Event Grid Domain with topics per service (e.g., 'inventory', 'shipping', 'billing'). Each service publishes events to its topic. Other services subscribe to relevant topics. The domain provides a single endpoint, simplifying network configuration. They use Azure AD authentication with managed identities for services running on Azure Kubernetes Service (AKS). This eliminates SAS key management. Scale: 50 topics, 500 events/second. Common issue: subscribers not acknowledging events within 30 seconds, causing retries and duplicate processing. Solution: Ensure subscriber processing is fast or use idempotent handlers.

An IoT solution collects telemetry from devices across multiple customers. Each customer is a tenant. Devices publish to a domain topic named after the tenant. The domain endpoint is used by all devices. Each tenant's analytics service subscribes to its topic. Domain topic-level authentication ensures device credentials are scoped. Dead-lettering captures failed events for replay. Misconfiguration: If the domain is deleted accidentally, all topics and subscriptions are lost. Mitigation: use resource locks and backups of domain configuration via ARM templates.