Clarification on Using Microsoft Entra ID for MQTT Authentication with Azure Event Grid

Question

Clarification on Using Microsoft Entra ID for MQTT Authentication with Azure Event Grid

Malik, Deepankar 25

Can Microsoft Entra ID be used as a valid authentication mechanism for publishing MQTT messages to Azure Event Grid via JWT (access token)?
If yes, could you clarify the token acquisition flow and required scopes?
Are there specific constraints or supported client SDKs for Entra ID JWT-based MQTT authentication?

Malik, Deepankar 25 Reputation points

2025-10-09T12:26:57.7366667+00:00
@VEMULA SRISAI Thank you for the detailed response regarding Microsoft Entra ID JWT authentication for Azure Event Grid MQTT.

I have reviewed the documentation at Microsoft Entra JWT authentication and RBAC authorization and have a specific question about the MQTT Broker Client configuration process.

Question on Client Certificate Authentication Validation Scheme

When creating the MQTT Broker Client in the Azure portal, the configuration requires setting a "Client Certificate Authentication Validation Scheme" field, which appears to be mandatory.

My specific question is:

Does a publisher using Microsoft Entra ID JWT authentication need to provide both:

X.509 client certificate and private key (for the Client Certificate Authentication Validation Scheme)

JWT access token (for Microsoft Entra ID authentication)

Or is the JWT token sufficient on its own for authentication?

Attached is the screenshot for the MQTT Broker Client configurationMQTT Boker_Client Config_1.jpg
Malik, Deepankar 25 Reputation points

2025-10-09T12:27:23.59+00:00

MQTT Boker_Client Config_2.jpg
VEMULA SRISAI 3,090 Reputation points Microsoft External Staff Moderator

2025-10-09T22:40:41.5233333+00:00

Malik, Deepankar Thank you for your response.

Below is the answer for your question.

The JWT access token is sufficient on its own for authentication when using Microsoft Entra ID JWT authentication. You do not need to provide an X.509 client certificate and private key for the Client Certificate Authentication Validation Scheme in this context. The authentication is performed using the JWT provided in the MQTT v5 CONNECT packet, and the token can also be refreshed using the MQTT v5 AUTH packet.
VEMULA SRISAI 3,090 Reputation points Microsoft External Staff Moderator

2025-10-13T21:46:46.2966667+00:00

Malik, Deepankar I wanted to follow up regarding my previous response about JWT authentication with Microsoft Entra ID. Please let me know if this resolves your concern, or if you need any further clarification or assistance

1 answer

Your answer

Malik, Deepankar 25 Reputation points

2025-10-09T12:26:57.7366667+00:00

@VEMULA SRISAI Thank you for the detailed response regarding Microsoft Entra ID JWT authentication for Azure Event Grid MQTT.

I have reviewed the documentation at Microsoft Entra JWT authentication and RBAC authorization and have a specific question about the MQTT Broker Client configuration process.

Question on Client Certificate Authentication Validation Scheme

When creating the MQTT Broker Client in the Azure portal, the configuration requires setting a "Client Certificate Authentication Validation Scheme" field, which appears to be mandatory.

My specific question is:

Does a publisher using Microsoft Entra ID JWT authentication need to provide both:

X.509 client certificate and private key (for the Client Certificate Authentication Validation Scheme)

JWT access token (for Microsoft Entra ID authentication)

Or is the JWT token sufficient on its own for authentication?

Attached is the screenshot for the MQTT Broker Client configurationMQTT Boker_Client Config_1.jpg
Malik, Deepankar 25 Reputation points

2025-10-09T12:27:23.59+00:00

MQTT Boker_Client Config_2.jpg
VEMULA SRISAI 3,090 Reputation points Microsoft External Staff Moderator

2025-10-09T22:40:41.5233333+00:00

Malik, Deepankar Thank you for your response.

Below is the answer for your question.

The JWT access token is sufficient on its own for authentication when using Microsoft Entra ID JWT authentication. You do not need to provide an X.509 client certificate and private key for the Client Certificate Authentication Validation Scheme in this context. The authentication is performed using the JWT provided in the MQTT v5 CONNECT packet, and the token can also be refreshed using the MQTT v5 AUTH packet.
VEMULA SRISAI 3,090 Reputation points Microsoft External Staff Moderator

2025-10-13T21:46:46.2966667+00:00

Malik, Deepankar I wanted to follow up regarding my previous response about JWT authentication with Microsoft Entra ID. Please let me know if this resolves your concern, or if you need any further clarification or assistance

Answer 1

Hello Malik, Deepankar,

Thank you for posting your question in Microsoft Q&A Forum.

Here is the Clarification on Using Microsoft Entra ID for MQTT Authentication with Azure Event Grid.

1.Can Microsoft Entra ID be used as a valid authentication mechanism for publishing MQTT messages to Azure Event Grid via JWT (access token)?

Yes, Microsoft Entra ID can be used as a valid authentication mechanism for publishing MQTT messages to Azure Event Grid via JWT (access token). This authentication method requires the use of the MQTT v5 protocol version. When connecting, the client uses the MQTT v5 CONNECT packet to provide the Microsoft Entra JWT as authentication data. Additionally, the AUTH packet can be utilized to refresh the token as needed.

To ensure proper authentication, the audience claim (aud) in the JWT must be set to https://eventgrid.azure.net/. This is essential for the authentication process to be successful. Moreover, clients must be authorized to communicate with the Event Grid namespace, which can be accomplished by assigning the appropriate roles, such as the EventGrid TopicSpaces Publisher role, to allow clients to publish messages.

For your reference:

Microsoft Entra JWT authentication and RBAC authorization for clients with Microsoft Entra identi…

2.If yes, could you clarify the token acquisition flow and required scopes?

Yes. To acquire the token, use the OAuth 2.0 client credentials flow with Microsoft Entra ID. Send a POST request to:

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Include grant_type=client_credentials, your client_id and client_secret, and set the scope to:

https://eventgrid.azure.net/.default

This scope ensures the token is valid for Event Grid. The token must have aud=https://eventgrid.azure.net/. Use this token in the MQTT v5 CONNECT packet with Authentication Method = OAUTH2-JWT. For refresh, use the MQTT v5 AUTH packet

3.Are there specific constraints or supported client SDKs for Entra ID JWT-based MQTT authentication?

Yes, there are specific constraints and supported client SDKs for Entra ID JWT-based MQTT authentication. The authentication method requires the use of the MQTT v5 protocol version. Additionally, you can authenticate MQTT clients with Microsoft Entra JWT to connect to the Event Grid namespace and use Azure role-based access control (Azure RBAC) to manage permissions for these clients.

The supported client SDKs for publishing events to Event Grid using Entra ID JWT authentication include:

Java SDK
.NET SDK
Python SDK
JavaScript SDK

These SDKs support all authentication methods, including Microsoft Entra authentication, and provide the necessary tools to implement the authentication process effectively.

References:

Please let me know if you need any additional information or further assistance.

Share via

Clarification on Using Microsoft Entra ID for MQTT Authentication with Azure Event Grid

1 answer

Your answer