Event Grid cross-tenant delivery using Managed Identity fails with “Internal error” when creating Event Subscription

Hi,

I’m implementing cross-tenant Event Grid delivery using Managed Identity, following this official Microsoft doc:

https://learn.microsoft.com/azure/event-grid/cross-tenant-delivery-using-managed-identity

I have two tenants:

• Customer tenant (Tenant A)
  • Contains the Storage Account
  • Has the Event Grid system topic
  • Created a user-assigned managed identity (UAMI) and assigned it to the system topic
  • Trying to create a cross-tenant event subscription
  Vega (SaaS) tenant (Tenant B) Contains a Service Bus namespace + queue

    Contains a **multi-tenant application** with a **Federated Identity Credential (FIC)**
  
          Issuer = Customer tenant
  
                Subject = clientId of the UAMI
  
                      Audience = `api://AzureADTokenExchange`
  
                         The Vega app’s service principal has **Azure Service Bus Data Sender** role on the queue
  

This matches the steps described in the documentation exactly.

Problem

When I try to create the Event Grid subscription in the customer tenant using cross-tenant delivery:

Endpoint type: Service Bus Queue

Cross-tenant delivery: Enabled

Managed identity type: User Assigned

Managed identity: the UAMI assigned to the system topic

Federated identity credentials (multitenant application ID): the Vega appId

The deployment fails immediately with:

Deployment has failed with the following error:
{"code":"Internal error","message":"The operation failed due to an internal server error. 
The initial state of the impacted resources (if any) are restored. 
Please try again in few minutes. If error still persists, report 
12471e63-0fca-4eec-bc39-6d75375764cb:11/27/2025 8:59:39 AM (UTC) 
to our forums for assistance or raise a support ticket ."}

There are no additional details in Activity Log.

Operation ID shown in the error:

12471e63-0fca-4eec-bc39-6d75375764cb Timestamp: 2025-11-27 08:59:39 UTCHi,

I’m implementing cross-tenant Event Grid delivery using Managed Identity, following this official Microsoft doc:

https://learn.microsoft.com/azure/event-grid/cross-tenant-delivery-using-managed-identity

I have two tenants:

Customer tenant (Tenant A)

Contains the Storage Account

  Has the **Event Grid system topic**
  
     Created a **user-assigned managed identity (UAMI)** and assigned it to the system topic
     
        Trying to create a cross-tenant event subscription
        
        **Vega (SaaS) tenant** (Tenant B)
        
           Contains a **Service Bus namespace + queue**
           
              Contains a **multi-tenant application** with a **Federated Identity Credential (FIC)**
              
                    Issuer = Customer tenant
                    
                          Subject = clientId of the UAMI
                          
                                Audience = `api://AzureADTokenExchange`
                                
                                   The Vega app’s service principal has **Azure Service Bus Data Sender** role on the queue
                                   

This matches the steps described in the documentation exactly.

Problem

When I try to create the Event Grid subscription in the customer tenant using cross-tenant delivery:

Endpoint type: Service Bus Queue

Cross-tenant delivery: Enabled

Managed identity type: User Assigned

Managed identity: the UAMI assigned to the system topic

Federated identity credentials (multitenant application ID): the Vega appId

The deployment fails immediately with:

Deployment has failed with the following error:
{

There are no additional details in Activity Log.

Operation ID shown in the error:

12471e63-0fca-4eec-bc39-6d75375764cb
Timestamp: 2025-11-27 08:59:39 UTC