Problems with MQTT client subscriber and Azure Event Grid

Question

Problems with MQTT client subscriber and Azure Event Grid

Mark Pope 50

I have two MQTT Java clients that are using different Service Principals for authentication, a publisher and a subscriber. The subscriber uses and async class that listens and should print out received MQTT messages. When I publish 10 MQTT message from the publisher the subscriber does not receive them. My Topic and Event Hub get the 10 MQTT messages.

I have created a subscriber and publisher topic space. Each has a template with #. I assume this will allow any messages to be published and consumed.I have created permission bindings for each for Publisher and Subscriber, both use Client Group $all.

The correct roles have been applied.

One thing I have notice is under Entra ID -> Monitoring -> Sign-in logs for Service Principals I only see entries for my Publisher and not my Subscriber. I corrupted my Subscriber credential to make my client fail upon connection to ensure it wasn't hiding an auth failure. I'm at a loss for further debugging.

Mark Pope 50 Reputation points

2025-04-08T16:15:12.1233333+00:00

Thanks for that I'll re-verify my setting. I noticed in the Event Grid namespace overview there are MQTT Failed Subscription events. I think I need to recheck what you suggested.
Mark Pope 50 Reputation points

2025-04-08T21:15:27.6533333+00:00

I verified all settings documenting them below. Did I miss something?
Mark Pope 50 Reputation points

2025-04-09T15:36:47.41+00:00

Good Morning Sander,

Yes, I have ensured that role is assigned to my service principal. I've done numerous things like swtiching from Eclips Paho MQTT libs to HiveMQ, creating new top with permission bindings for the publisher and subscriber with no success. I must be overlooking something.
Sander van de Velde | MVP 36,146 Reputation points MVP

2025-04-09T18:50:31.62+00:00

Hello @Mark Pope ,

It's hard to make an educated guess without an actual settings example.

Perhaps it's possible to step away from the managed identities for try to connect using a certificate first, as seen in this post?
Mark Pope 50 Reputation points

2025-04-09T21:01:55.7033333+00:00

I'm working on getting a root cert, as our clients demand X.509 security. In the meantime I decided to dust off my coding skills with Java clients. I will try to follow the instructions in your post and use MQTTx. Thanks.
Mark Pope 50 Reputation points

2025-04-10T22:00:55.18+00:00

Sander van de Velde | MVP I got it to work following your post, thanks! I finally figured out my problem with service principals. They have to be set in the cmd or shell running my Java program. My build tool(maven) allows system properties to be defined before running Java and they were not being set. I appreciate all the help.
Shireesha Eeraboina 2,815 Reputation points Microsoft External Staff

2025-04-11T04:49:51.0066667+00:00

Hello Mark Pope,

Thanks for your response and glad to know that your problem has been resolved. please click Accept Answer and Yes for the provided answer. This will help other community members with similar issues find the solution more easily.

2 answers

Your answer

Mark Pope 50 Reputation points

2025-04-08T16:15:12.1233333+00:00

Thanks for that I'll re-verify my setting. I noticed in the Event Grid namespace overview there are MQTT Failed Subscription events. I think I need to recheck what you suggested.
Mark Pope 50 Reputation points

2025-04-08T21:15:27.6533333+00:00

I verified all settings documenting them below. Did I miss something?
Mark Pope 50 Reputation points

2025-04-09T15:36:47.41+00:00

Good Morning Sander,

Yes, I have ensured that role is assigned to my service principal. I've done numerous things like swtiching from Eclips Paho MQTT libs to HiveMQ, creating new top with permission bindings for the publisher and subscriber with no success. I must be overlooking something.
Sander van de Velde | MVP 36,146 Reputation points MVP

2025-04-09T18:50:31.62+00:00

Hello @Mark Pope ,

It's hard to make an educated guess without an actual settings example.

Perhaps it's possible to step away from the managed identities for try to connect using a certificate first, as seen in this post?
Mark Pope 50 Reputation points

2025-04-09T21:01:55.7033333+00:00

I'm working on getting a root cert, as our clients demand X.509 security. In the meantime I decided to dust off my coding skills with Java clients. I will try to follow the instructions in your post and use MQTTx. Thanks.
Mark Pope 50 Reputation points

2025-04-10T22:00:55.18+00:00

Sander van de Velde | MVP I got it to work following your post, thanks! I finally figured out my problem with service principals. They have to be set in the cmd or shell running my Java program. My build tool(maven) allows system properties to be defined before running Java and they were not being set. I appreciate all the help.
Shireesha Eeraboina 2,815 Reputation points Microsoft External Staff

2025-04-11T04:49:51.0066667+00:00

Hello Mark Pope,

Thanks for your response and glad to know that your problem has been resolved. please click Accept Answer and Yes for the provided answer. This will help other community members with similar issues find the solution more easily.

Answer 1

Hi Mark Pope,

It seems that your subscriber client may not be connecting properly to the Azure Event Grid namespace. Here are a few things you can check:

Ensure that the subscriber client has the correct client identity entry created with the service.
Verify that the authentication credentials for the subscriber are configured correctly.
Check if the subscriber client is part of the correct client group with subscriber permissions on the topic space.
Make sure that the subscriber client is using a unique Client ID and that the topic to which it is subscribing exists.

Since you mentioned that you only see entries for the publisher in the Entra ID sign-in logs, it indicates that the subscriber may not be connecting at all.

To help you better understand, kindly refer to the documentations below:

I hope this addresses your query. Please let me know if you need any further assistance or clarification.

Answer 2

Hello @Mark Pope ,

welcome to this moderated Azure community forum.

It seems your connect via an AAD account.

Did you provide the 'EventGrid TopicsSpaces Subscriber role to your subscriber? User's image

Update, the issue is related to system properties:

... service principals. They have to be set in the cmd or shell running my Java program. My build tool(maven) allows system properties to be defined before running Java and they were not being set.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Share via

Problems with MQTT client subscriber and Azure Event Grid

2 answers

Your answer