Build Event Grid custom topic configs with CloudEvents schema, event subscriptions, advanced filters, and dead-letter destinations.
Build Event Grid custom topic configs with CloudEvents schema, event subscriptions, advanced filters, dead-letter destinations, and private endpoints.
Required Fields
topicNameresourceGroupinputSchemaeventSubscriptionseventSubscriptions[0].nameeventSubscriptions[0].destinationOutput will appear here...Build an Azure Event Grid custom topic with CloudEvents schema, event subscriptions combining basic filters (subjectBeginsWith, includedEventTypes) with advancedFilters operating on arbitrary event data fields (NumberGreaterThan on data.totalAmount, StringIn on data.region), a deadLetterDestination for events that exhaust retryPolicy.maxDeliveryAttempts, and deliveryWithResourceIdentity authenticating the push to the destination via managed identity rather than a shared access key. retryPolicy's maxDeliveryAttempts (30) combined with eventTimeToLiveInMinutes (1440, 24 hours) together bound how persistently Event Grid retries a failing delivery before giving up and routing to the dead-letter destination, both values need to be considered together, a high attempt count with a short TTL can exhaust the TTL window before reaching the attempt limit, meaning the effective retry behavior is actually governed by whichever limit is hit first.
It routes to the configured deadLetterDestination (if one is set) rather than being redelivered further, if no dead-letter destination is configured, the event is simply dropped after exhausting retries with no persisted record of the failed delivery at all, always configure a dead-letter destination for any subscription where losing a failed-delivery event silently would be a problem.
They operate on the event's data payload fields specifically (like data.totalAmount or data.region in the example), distinct from basic filters like subjectBeginsWith or includedEventTypes which operate on the event envelope's standard fields (subject, event type). This is what lets advancedFilters do genuinely content-based routing, filtering on values inside the actual business event payload, not just metadata about the event.
No, it changes how Event Grid authenticates to the destination (via managed identity rather than an embedded key/secret), but the destination itself still needs an actual role assignment or permission granted to that managed identity to accept the delivery, deliveryWithResourceIdentity is about removing a long-lived shared secret from the subscription config, not about bypassing the destination's own access control entirely.
The builder validates that topicName, resourceGroup, inputSchema, eventSubscriptions, and the first subscription's name/destination all resolve before accepting the JSON as a valid combined topic and subscription configuration; it can't verify the referenced destination resource IDs (Function, Event Hub) actually exist or that the managed identity has been granted the necessary permission on the destination, those are only confirmed when a real event actually attempts delivery.
Always configure a deadLetterDestination for any event subscription where a failed, un-retryable event matters, without one, an event that exhausts retries is simply gone with no record, a common and avoidable data-loss gap.
Consider maxDeliveryAttempts and eventTimeToLiveInMinutes together, not independently, a high attempt count paired with a short TTL means the TTL, not the attempt count, actually governs how long Event Grid keeps retrying, verify the combination reflects your actual intended retry duration.
Prefer deliveryWithResourceIdentity over an embedded function key or shared access signature in the destination configuration wherever the destination type supports it, removing a long-lived secret from the subscription config in favor of managed identity is a straightforward security improvement.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.