Errors when adding a MQTT custom domain to an Event Grid Namespace

Hi Andy,

Apologies for the delay in response.

1. Try listing the available identities in your subscription and check if the user assigned managed identity still exists.
   • Run the following command to list all User Assigned Managed Identities (UAMI):

      az identity list --subscription <your-subscription-id> -o table
   

   • To check if a specific identity still exists, run:

      az identity show --name <identity-name> --resource-group <resource-group-name>
   

2. Also please share your NS.json if possible.

Hi Andy,

I hope you checked the response, and it was helpful. Please do let me know if you need any further assistance on this.

Thanks

Hi Pravallika,

I have shared the NS.json contents in a private message. I have run the az identity list and show commands and they confirm the UAMI no longer exists. Again it is unclear why the error references a previously deleted UAMI when "System Assigned" was selected on the portal add domain form and the UAMI name referenced in the error was never referenced on the add domain form.

Hi Andy,

Even though the UAMI no longer exists, Event Grid’s control plane resource metadata can still hold a stale identity reference, and the error occurs due to stale metadata in the Event Grid Namespace referencing a deleted User Assigned Managed Identity.

So even when you select System Assigned for a new operation, the backend API may still include both identities in the request payload. This happens when the ARM and the Azure Portal cache identity references are not cleared completely.

When the Event Grid service backend attempts to authenticate against Key Vault, it tries the stale UAMI first, fails, and emits the error pointing to the deleted identity.

Check whether your Event Grid Namespace still has that stale reference by running:

az resource show --ids /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.EventGrid/namespaces/<NAMESPACE_NAME> --query "identity"

Force identity metadata refresh by detaching all identities and reattach cleanly:

1: Remove all identities:

az resource update --ids /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.EventGrid/namespaces/<NAMESPACE_NAME> --set identity.type="None" 

2: Re-add system assigned identity only:

az resource update --ids /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.EventGrid/namespaces/<NAMESPACE_NAME> --set identity.type="SystemAssigned"

Wait for 5–10 minutes for propagation before retrying the custom domain creation.

Recreate namespace cleanly:

If ARM continues to hold a reference to the deleted identity:

• Delete the existing Event Grid Namespace and recreate a new one.
• Enabling System Assigned Identity before any Key Vault bindings or domain creation.
• Use CLI to add domain to avoids stale cached schema.

The initial query (show identities command) on the event grid namespace confirmed that the namespace is both UserAssigned and SystemAssigned, with the userAssignedIdentities containing a reference to the previously deleted user assigned identity.

{
  "principalId": "---",
  "tenantId": "---",
  "type": "SystemAssigned, UserAssigned",
  "userAssignedIdentities": {
    "/subscriptions/---/resourceGroups/---/providers/Microsoft.ManagedIdentity/userAssignedIdentities/[PreviouslyDeletedUserAssignedIdentityNameHere]": {
      "clientId": "---",
      "principalId": "---"
    }
  }
}

The "Remove all identities" query has the following error:

(InvalidRequestContent) The request content was invalid and could not be deserialized: 'Required property 'type' not found in JSON. Path 'identity', line 1, position 725.'.
Code: InvalidRequestContent
Message: The request content was invalid and could not be deserialized: 'Required property 'type' not found in JSON. Path 'identity', line 1, position 725.'.

The "Remove all identities" query but with --set type="None" has the following error:

Code: FailedIdentityOperation
Message: Identity operation for resource '/subscriptions/---/resourceGroups/---/providers/Microsoft.EventGrid/namespaces/---' failed with error 'Failed to perform resource identity operation. Status: 'BadRequest'. Response: '{"error":{"code":"BadRequest","message":"Resource '/subscriptions/---/resourcegroups/---/providers/Microsoft.ManagedIdentity/userAssignedIdentities/[PreviouslyDeletedUserAssignedIdentityNameHere]' was not found."}}'.'.

I tried creating a new namespace that was System Assigned Identity on create, but cannot use the CLI to add the domain because I still need guidance on the NS.json failure - see private message the JSON contents. Using the portal to add the domain with the new namespace still generates this error:

Custom domain addition failed with error: "The operation failed due to an internal server error. The initial state of the impacted resources (if any) are restored. Please try again in few minutes. If error still persists, report 6810d792-280e-49e4-b6fd-9f1b7aac0974:10/24/2025 4:20:17 PM (UTC) to our forums for assistance or raise a support ticket ."

Andy,

Try clearing all the identity metadata explicitely:

The CLI --set identity.type="None" fails because the Event Grid namespace schema is strict. Clear the whole identity object, not just the type property by using below command.

az resource update --ids /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.EventGrid/namespaces/<NAMESPACE_NAME> --remove identity

This forcibly removes the entire identity block, including stale UAMI references.

Running the command to forcibly remove the entire identity block causes the CLI to pause for 5 seconds and then it outputs the namespace details in JSON, including the identity.userAssignedIdentities list that contains the stale / previously deleted identity.

After this command completes and after waiting several minutes, running the command below to view the namespace identity details - it still shows the previously deleted user assigned identity. The suggested remove command had no effect.

az resource show --ids /subscriptions/<SUB_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.EventGrid/namespaces/<NAMESPACE_NAME> --query "identity"

Hi Andy,

I am checking your NS.json payload. In the meantime, could you please try creating the domain using the below commands. The parameters available to create domain using AZ CLI are mentioned in MSDOC1 and MSDOC2:

az eventgrid domain create --name
                           --resource-group
                           [--identity {noidentity, systemassigned}]
                           [--inbound-ip-rules]
                           [--input-mapping-default-values]
                           [--input-mapping-fields]
                           [--input-schema {cloudeventschemav1_0, customeventschema, eventgridschema}]
                           [--location]
                           [--mi-system-assigned]
                           [--mi-user-assigned]
                           [--public-network-access {disabled, enabled}]
                           [--sku {basic, premium}]
                           [--tags]

az eventgrid domain topic create --domain-name
                                 --name
                                 --resource-group

Also, could you please confirm if the Json payload you are using is related to REST API? As I can see the some of the parameters mentioned in the Payload are not supported in CLI.

The JSON payload is from the documentation you referenced on Oct 20 - Azure CLI example NS.json

Can the Add Custom Domain feature in the Azure be fixed so that it is functional?