Subscribe to Azure Resource Management events in Event Grid

1. Set the account to the Azure subscription where you wish to create the system topic.

   az account set -s AZURESUBSCRIPTIONID
   

2. Create a system topic of type microsoft.resourcenotifications.resources using the az eventgrid system-topic create command.

   az eventgrid system-topic create \
               --name SYSTEMTOPICNAME \
               --resource-group RESOURCEGROUPNAME \
               --source /subscriptions/AZURESUBSCRIPTIONID \
               --topic-type microsoft.resourcenotifications.resources \
               --location Global        
   

1. Set the account to the Azure subscription where you wish to create the system topic.

   Set-AzContext -Subscription AZURESUBSCRIPTIONID
   

2. Create a system topic of type microsoft.resourcenotifications.resources using the New-AzEventGridSystemTopic command.

   New-AzEventGridSystemTopic -name SYSTEMTOPICNAME `
                   -resourcegroup RESOURCEGROUPNAME `
                   -source /subscriptions/AZURESUBSCRIPTIONID `
                   -topictype microsoft.resourcenotifications.resources `
                   -location global    
   

1. Sign into the Azure portal.

2. In the search bar, type Event Grid System Topics, and select it from the drop-down list.

3. On the Event Grid system topics page, select Create on the toolbar.

4. On the Create Event Grid System Topic page, select Resource Management events for Topic type.

   

5. Select the resource group in which you want to create the system topic.

6. Enter a name for the system topic.

7. Select Review + create

8. On the Review + create page, select Create.

9. On the successful deployment page, select Go to resource to navigate to the page for your system topic. You see the details about your system topic on this page.

Create an event subscription for the above topic using the az eventgrid system-topic event-subscription create command.

The following sample command creates an event subscription for both CreatedOrUpdated and Deleted events. If you don't specify included-event-types, all the event types are included by default.

az eventgrid system-topic event-subscription create \
                --name EVENTSUBSCRIPTIONNAME \
                --resource-group RESOURCEGROUPNAME \
                --system-topic-name SYSTEMTOPICNAME \
                --included-event-types Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted \
                --endpoint /subscriptions/AZURESUBSCRIPTIONID/resourceGroups/RESOURCEGROUPNAME/providers/Microsoft.EventHub/namespaces/MYEVENTHUBSNAMESPACE/eventhubs/MYEVENTHUB \
                --endpoint-type eventhub        

Create an event subscription for the above topic using the New-AzEventGridSystemTopicEventSubscription command.

The following sample command creates an event subscription for both CreatedOrUpdated and Deleted events. If you don't specify IncludedEventType, all the event types are included by default.

New-AzEventGridSystemTopicEventSubscription -EventSubscriptionName EVENTSUBSCRIPTIONNAME `
                -ResourceGroupName RESOURCEGROUPNAME `
                -SystemtopicName SYSTEMTOPICNAME `
                -IncludedEventType Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted `
                -Endpoint /subscriptions/AZURESUBSCRIPTIONID/resourceGroups/RESOURCEGROUPNAME/providers/Microsoft.EventHub/namespaces/EVENTHUBSNAMESPACE/eventhubs/EVENTHUB `
                -EndpointType eventhub

1. On the Event Grid System Topic page, select Event Subscription on the toolbar.

2. Confirm that the Topic Type, Source Resource, and Topic Name are automatically populated.

3. Enter a name for the event subscription.

4. For Filter to event types, select the event, for example, CreatedOrUpdated or Deleted.

   

5. Select endpoint type.

6. Configure event handler based no the endpoint type you selected. In the following example, an Azure event hub is selected.

   

7. Select the Filters tab to provide subject filtering and advanced filtering. For example, to filter for events from resources in a specific resource group, follow these steps:

   1. Select Enable subject filtering.

   2. In the Subject Filters section, for Subject begins with, provide the value of the resource group in this format: /subscriptions/{subscription-id}/resourceGroups/{resourceGroup-id}.

      

8. Then, select Create to create the event subscription.

To delete the event subscription, use the az eventgrid system-topic event-subscription delete command. Here's an example:

az eventgrid system-topic event-subscription delete --name firstEventSubscription --resourcegroup sampletestrg --system-topic-name arnSystemTopicResources

To delete the system topic, use the az eventgrid system-topic delete command. Here's an example:

az eventgrid system-topic delete --name arnSystemTopicResources --resource-group sampletestrg

To delete an event subscription, use the Remove-AzEventGridSystemTopicEventSubscription command. Here's an example:

Remove-AzEventGridSystemTopicEventSubscription -EventSubscriptionName firstEventSubscription -ResourceGroupName sampletestrg -SystemTopicName arnSystemTopicResources

To delete the system topic, use the Remove-AzEventGridSystemTopic command. Here's an example:

Remove-AzEventGridSystemTopic -ResourceGroupName sampletestrg -Name arnSystemTopicResources

1. Sign in to the Azure portal.
2. In the search bar, type Event Grid System Topics, and press ENTER.
3. Select the system topic.
4. On the Event Grid System Topic page, select Delete on the toolbar.

az eventgrid system-topic event-subscription create \
	--name firstEventSubscription \
	--resource-group sampletestrg \
	--system-topic-name arnSystemTopicResources 
	--included-event-types Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted \
	--endpoint /subscriptions/000000000-0000-0000-0000-000000000000/resourceGroups/sampletestrg/providers/Microsoft.EventHub/namespaces/testEventHub/eventhubs/ehforsystemtopicresources \
	--endpoint-type evenhub \
    --advanced-filter data.resourceInfo.type StringEndsWith virtualMachines

New-AzEventGridSystemTopicEventSubscription -EventSubscriptionName firstEventSubscription `
            -ResourceGroupName sampletestrg `
            -SystemtopicName arnSystemTopicResources `
            -IncludedEventType Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted `
            -Endpoint /subscriptions/000000000-0000-0000-0000-000000000000/resourceGroups/sampletestrg/providers/Microsoft.EventHub/namespaces/testEventHub/eventhubs/ehforsystemtopicresources `
            -EndpointType eventhub `
            -AdvancedFilter @(@{operator = "StringEndsWith"; key = "data.resourceInfo.type" ; value ="virtualMachines"})

1. Choose CreatedOrUpdated and Deleted event types.

2. In the Filters tab of the event subscription, choose the following advanced filters.

   Key = "data.resourceInfo.type"
   Operator = "StringEndsWith" 
   Value = "virtualMachines"
   

az eventgrid system-topic event-subscription create \
	--name firstEventSubscription \
	--resource-group sampletestrg \
	--system-topic-name arnSystemTopicResources \
	--included-event-types Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted \
	--endpoint/subscriptions/000000000-0000-0000-0000-0000000000000/resourceGroups/sampletestrg/providers/Microsoft.EventHub/namespaces/testEventHub/eventhubs/ehforsystemtopicresources \
	--endpoint-type evenhub \
    --subject-begins-with /subscription/{Azure subscription ID}/resourceGroups/<Resource group name>/
	--advanced-filter data.resourceInfo.type StringEndsWith virtualMachines

New-AzEventGridSystemTopicEventSubscription -EventSubscriptionName firstEventSubscription `
            -ResourceGroupName sampletestrg `
            -SystemtopicName arnSystemTopicResources `
            -IncludedEventType Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted `
            -Endpoint /subscriptions/000000000-0000-0000-0000-000000000000/resourceGroups/sampletestrg/providers/Microsoft.EventHub/namespaces/testEventHub/eventhubs/ehforsystemtopicresources `
            -EndpointType eventhub -AdvancedFilter @(@{operator = "StringEndsWith"; key = "data.resourceInfo.type" ; value ="virtualMachines"})

In the Filters tab of the event subscription, enable subject filtering, and use the following subject filter:

Subject begins with = /subscriptions/{subscription-id}/resourceGroups/{resourceGroup-id}

Then, choose the following advanced filters.

Key = "data.resourceInfo.type"
Operator = "String ends with"
Value = "virtualMachines"

az eventgrid system-topic event-subscription create \
	--name firstEventSubscription \
	--resource-group sampletestrg \
	--system-topic-name arnSystemTopicResources \
	--included-event-types Microsoft.ResourceNotifications.Resources.CreatedOrUpdated \
	--endpoint/subscriptions/000000000-0000-0000-0000-0000000000000/resourceGroups/sampletestrg/providers/Microsoft.EventHub/namespaces/testEventHub/eventhubs/ehforsystemtopicresources \
	--endpoint-type evenhub \
    --subject-begins-with /subscription/{Azure subscription ID}/resourceGroups/<Resource group name>/
    --advanced-filter data.resourceInfo.location StringIn chinanorth 
    --advanced-filter data.resourceInfo.type StringEndsWith virtualMachines

New-AzEventGridSystemTopicEventSubscription -EventSubscriptionName firstEventSubscription `
            -ResourceGroupName sampletestrg `
            -SystemtopicName arnSystemTopicResources `
            -IncludedEventType Microsoft.ResourceNotifications.Resources.CreatedOrUpdated, Microsoft.ResourceNotifications.Resources.Deleted `
            -Endpoint /subscriptions/000000000-0000-0000-0000-000000000000/resourceGroups/sampletestrg/providers/Microsoft.EventHub/namespaces/testEventHub/eventhubs/ehforsystemtopicresources `
            -EndpointType eventhub `
            -AdvancedFilter @(@{operator = "StringIn"; key = "data.resourceInfo.location"; value ="chinanorth"}, @{operator = "StringEndsWith"; key = "data.resourceInfo.type" ; value ="virtualMachines"})

In the Filters tab of the event subscription, enable subject filtering, and use the following subject filter:

Subject begins with = /subscriptions/{subscription-id}/resourceGroups/{resourceGroup-id}

Then, choose the following advanced filters.

Key = "data.resourceInfo.location",
Operator = "String is in"
Value = "chinanorth"

AND

Key = "data.resourceInfo.type", Operator = "String ends with" Value = "virtualMachines"