Unable to create System Topic in Event Grid due to Unable to verify access to resource

Hi @Mathieu Isabel ,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

One of major causes for this is access. Could you please try below and share your findings.

• Do you have contributor access while creating. Please try creating with Owner access and see if it gets created.
• If Owner is not possible, please try with roles - EventGrid Contributor and EventGrid EventSubscription Contributor
• Could you please check and allow access to ACS resource on Event Grid. Add Role - EventGrid Contributor. ACS can be configured with private endpoints. If the resource blocks platform services, Event Grid’s validation will fail.

I've tried with an elevated account that has Service Administrator and it's still the same issue. On the last point, I'm not sure how I can add Event Grid access to ACS while creating the topic as its managed identity doesn't exist yet.

I've also tried creating a system topic for a storage account and same issue happens.

Hi Mathieu Isabel,

Could you please review the role assignments listed below

Assign built-in role "EventGrid Contributor" or "EventGrid EventSubscription Contributor" on the ACS resource.

This permission is needed for Event Grid to verify and subscribe to the ACS(Azure Communication Service) events.

To clarify, who exactly should be granted EventGrid Contributor? The user creating the System Topic? I cannot give access to an EventGrid managed identity as the EventGrid resource hasn't been created yet.

If I go in IAM in the portal, I can see that particular role under the ACS resource.

But if I try to assign a user/identity to that role, it's not showing up in the list of roles.

Is it normal that running doesn't return anything?
az eventgrid system-topic list
returns

[]

Hi Mathieu Isabel, Thanks for sharing details and patience

1.The EventGrid Contributor role isn’t meant for the user who’s creating the system topic. Instead, it’s intended for the managed identity that Event Grid automatically creates once the system topic is successfully provisioned.Here’s how it works.

As the creator, you only need Contributor permissions on the resource group where you’re creating the system topic, and Reader access on the source resource (for example, Azure Communication Services).

The Event Grid system topic’s managed identity will later need the EventGrid Contributor (or EventGrid Data Sender) role on the source resource.

• However, this managed identity does not exist until the system topic is created, so you can’t assign the role beforehand. Once the topic is created successfully, you can then grant the necessary permissions to its managed identity.

2.If az eventgrid system-topic list returns nothing, that’s expected in some cases:

You haven’t successfully created any system topics yet in that subscription or region.

You’re listing in the wrong scope (for example, not specifying the correct resource group).

Once a system topic is successfully created, it will appear in the az eventgrid system-topic list output, and a managed identity will automatically be linked to it. At that point, you can assign the necessary Event Grid roles to that identity.

The system topic creation fails if you set up Azure policies in such a way that the Event Grid service can't create it. For example, you can have a policy that allows creation of only certain types of resources (for example: Azure Storage, Azure Event Hubs, and so on) in the subscription. In such cases, event flow functionality is preserved. However, metrics and diagnostic functionalities of system topics are unavailable. If you require this functionality, allow creation of resources of the system topic type, and create the missing system topic as described in the Lifecycle of system topics section.

Refer document: https://free.blessedness.top/en-us/azure/event-grid/system-topics

Could you please provide answers to the following questions? This will help us investigate the issue more efficiently.

• could you please confirm that the Event Grid resource provider is fully registered?
• confirm you have contributor access at resource group and least reader access at ACS resources?
• Have you checked if there are any restrictions set by Azure Policies at the subscription or resource group level?
• For Azure event sources in a specific region, are you trying to create the system topic created in the same location as the event source?
• Have you checked any event logs for specific error logs?