Microsoft Graph Event Hub Subscription fails with ValidationError despite verified configuration

Question

Microsoft Graph Event Hub Subscription fails with ValidationError despite verified configuration

MQ 0

Problem Description

I'm unable to create Microsoft Graph Change Notification subscriptions with Azure Event Hub as the notification endpoint. The subscription creation consistently fails with a ValidationError.

Error Message

{
  "error": {
    "code": "ValidationError",
    "message": "Invalid event hub notification url=''.",
    "innerError": {
      "date": "2025-10-19T09:29:16",
      "request-id": "4cfd1dca-d878-41e8-8d0e-e8c9d2a59941"
    }
  }
}

Configuration (All Verified ✓)

Event Hub:

Namespace: mycompany-eventhub.servicebus.windows.net
Event Hub Name: todo-sync
Status: Active
Region: West Europe

Connection String:

✓ Contains EntityPath=todo-sync
✓ SharedAccessKeyName: GraphChangeNotifications
✓ Format: Endpoint=sb://...;SharedAccessKeyName=...;SharedAccessKey=...;EntityPath=todo-sync

Permissions (Microsoft Graph Change Tracking):

✓ Service Principal ID: fcbbf149-8ca2-4f2a-96e4-8a12b37191ff
✓ Namespace-Level: Azure Event Hubs Data Sender
✓ Event Hub-Level: Azure Event Hubs Data Sender + Data Receiver
✓ Verified via az role assignment list

Network:

✓ Public Network Access: Enabled
✓ Network Default Action: Allow
✓ Event Hub publicly accessible (tested via Test-NetConnection)

Notification URL:

Format: EventHub:https://mycompany-eventhub.servicebus.windows.net/todo-sync?tenantId=mycompany.onmicrosoft.com
Using domain name (not GUID)
Length: 100 characters
Follows Microsoft documentation specification

Subscription Request

POST https://graph.microsoft.com/v1.0/subscriptions

{
  "changeType": "created,updated,deleted",
  "notificationUrl": "EventHub:https://mycompany-eventhub.servicebus.windows.net/todo-sync?tenantId=mycompany.onmicrosoft.com",
  "resource": "/users/{userId}/todo/lists/{listId}/tasks",
  "expirationDateTime": "2025-10-21T...",
  "clientState": "..."
}

Troubleshooting Steps Already Taken

✓ Created Shared Access Policy on Event Hub level (not namespace)
✓ Verified EntityPath is present in connection string
✓ Assigned both RBAC roles (Data Sender + Receiver) to Microsoft Graph service principal
✓ Enabled Public Network Access on namespace
✓ Set Network Default Action to "Allow"
✓ Tested with both Tenant GUID and domain name in URL
✓ Waited 2+ hours for permission propagation
✓ Verified network connectivity to Event Hub hostname (successful)
✓ Confirmed Microsoft Graph service principal exists in tenant

Documentation Followed

Observed Behavior

Microsoft Graph receives the notification URL (hash changes when URL is modified)
ValidationError occurs during Event Hub validation phase
Error is consistent and reproducible across multiple attempts
Same error regardless of using Tenant GUID vs domain name

Similar Reports

This issue appears in some public forums:

Stack Overflow: "Invalid event hub notification url" with correct configuration
Microsoft Q&A: Multiple reports of ValidationError with Event Hub subscriptions
Some reports mention tenant-specific issues

Questions

Is there a tenant-specific configuration preventing Event Hub validation?
Are there additional undocumented requirements for Event Hub subscriptions?
Is this a known issue with Microsoft Graph Event Hub integration?

Environment

Microsoft Entra ID License: P1
Event Hub Tier: Standard
Region: West Europe
Microsoft Graph API: v1.0

Any guidance would be greatly appreciated.

Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-21T05:52:53.5266667+00:00
Hi MQ,

Thanks for the question and using Microsoft Q&A platform.

The ValidationError usually means Microsoft Graph couldn’t verify or connect to your Event Hub when creating the subscription. This often happens because of a small URL format issue, permission scope, or network access setting.

Please check these:

Make sure your notification URL is exactly in this format
EventHub:https://<namespace>.servicebus.windows.net/<eventhubname>?tenantId=<your-tenant-domain-or-ID>
Try both your tenant domain and tenant ID sometimes one works better than the other.

Confirm that the Microsoft Graph Change Tracking service principal has the Azure Event Hubs Data Sender role at the namespace level (not just at the Event Hub level).

If your Event Hub is using network restrictions, please enable public access temporarily and test again.

If it still fails, please share request ID from the error, UTC time of the failure.

Do let me know if you have any queries, we are happy to assist you further.

Thanks,
Manoj
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-22T03:19:38.42+00:00

Hi MQ,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Thanks,
Manoj
MQ 0 Reputation points

2025-10-22T07:43:59.7833333+00:00

Hi Manoj,

Thanks - I've verified all configuration as suggested:

Still getting ValidationError with both formats:

Test 1 (Domain):

Request ID: (removed)

UTC Time: 2025-10-22T07:39:25Z

Error: Invalid event hub notification url='<scrub>eventhub:///...'

Test 2 (GUID):

Request ID: (removed)

UTC Time: 2025-10-22T07:39:25Z

Error: Invalid event hub notification url='<scrub>eventhub:///...'

URL Format used:

EventHub:https://[namespace].servicebus.windows.net/[eventhub-name]?tenantId=[tenant]

Please advise on next steps. Is this a known issue with specific Azure tenants or Event Hub configurations?

Thank you
MQ
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-22T08:51:24.25+00:00
Hi MQ,

Thanks for checking everything and sharing the request IDs that’s really helpful. From your details, this looks like Graph isn’t able to validate the Event Hub endpoint, even though your setup appears correct.

Let’s confirm a couple of things that often resolve this:

1.Check the role assignment identity Run this in Azure CLI:

az ad sp show --id fcbbf149-8ca2-4f2a-96e4-8a12b37191ff --query "objectId" -o tsv

Then go to Access Control (IAM) on your Event Hub namespace and make sure the same objectId is listed under the Azure Event Hubs Data Sender role. Sometimes the role is assigned to the appId instead of the service principal objectId, and Graph can’t validate it.

2.Test with a new Shared Access Policy (Send permission) Create a temporary Send policy on the Event Hub and test again. If that works, it usually means the RBAC role hasn’t propagated fully yet.

3.Check the exact notification URL Make sure it matches exactly:

EventHub:https://<namespace>.servicebus.windows.net/<eventhub-name>?tenantId=<tenant-domain-or-id>

No trailing slashes, and try both the tenant domain and GUID.

4.If all checks pass and it still fails This might be a backend validation issue on Microsoft Graph’s side. Please open a support case and share these details:

Request IDs and UTC times (which you already provided)

The subscription body (minus secrets)

Confirmation that the correct service principal objectId has the Data Sender role

That info lets the Graph team trace the validation call internally.

Let’s try the identity check first and see if that resolves it.

Thanks,
Manoj
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-23T08:59:03.9933333+00:00

Hi MQ,
We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.

Thanks,
Manoj
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-24T08:52:26.5766667+00:00

Hi MQ,

We hope the above steps were helpful. If you have any other questions, please feel free to contact us.

Thanks,
Manoj
MQ 0 Reputation points

2025-10-27T14:22:02.1+00:00
Hi Manoj,

Thank you for your continued support. I've completed all verification steps:

✅ Service Principal Object ID Verified:

Object ID: (removed)

RBAC role assigned at namespace level (confirmed via Azure CLI)

✅ SAS Policy Test Completed:

Created new SAS policy "GraphTest" with Send permission

Same ValidationError occurs with SAS (bypassing RBAC entirely)

✅ Configuration Confirmed 100% Correct:

EntityPath present in connection string

URL format exactly per Microsoft specification

Network access: Public, allow all

Tested with both tenant domain and GUID

❌ Result: ValidationError persists with both RBAC and SAS authentication

Latest Test Details:

Request ID: (removed)

UTC Time: 2025-10-27T14:13:31Z

Notification URL: EventHub:https://<namespace>.servicebus.windows.net/<eventhub-name>?tenantId=<tenant-domain-or-ID>

Error: Invalid event hub notification url='<scrub>eventhub:///4A3ECB4D3E4BA556117A3B01873573F4CFFD979AE42AD484415673E5BB945DFE</scrub>'

Since the error occurs identically with both RBAC and SAS (which completely bypasses RBAC), this appears to be a Microsoft Graph backend validation issue rather than a configuration problem.

I will open a support case as suggested.

Thank you,

MQ
Anonymous

2025-10-27T14:56:22.2833333+00:00

Hi MQ,

Thank you for detailed response, can you please provide the requested details over the private messaging. It will help us to proceed further. If you have already raised Support ticket, can you please share the Ticket ID with Us.

Thanks!

Kalyani

Your answer

Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-21T05:52:53.5266667+00:00

Hi MQ,

Thanks for the question and using Microsoft Q&A platform.

The ValidationError usually means Microsoft Graph couldn’t verify or connect to your Event Hub when creating the subscription. This often happens because of a small URL format issue, permission scope, or network access setting.

Please check these:

Make sure your notification URL is exactly in this format
EventHub:https://<namespace>.servicebus.windows.net/<eventhubname>?tenantId=<your-tenant-domain-or-ID>
Try both your tenant domain and tenant ID sometimes one works better than the other.

Confirm that the Microsoft Graph Change Tracking service principal has the Azure Event Hubs Data Sender role at the namespace level (not just at the Event Hub level).

If your Event Hub is using network restrictions, please enable public access temporarily and test again.

If it still fails, please share request ID from the error, UTC time of the failure.

Do let me know if you have any queries, we are happy to assist you further.

Thanks,
Manoj
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-22T03:19:38.42+00:00

Hi MQ,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Thanks,
Manoj
MQ 0 Reputation points

2025-10-22T07:43:59.7833333+00:00

Hi Manoj,

Thanks - I've verified all configuration as suggested:

Still getting ValidationError with both formats:

Test 1 (Domain):

Request ID: (removed)

UTC Time: 2025-10-22T07:39:25Z

Error: Invalid event hub notification url='<scrub>eventhub:///...'

Test 2 (GUID):

Request ID: (removed)

UTC Time: 2025-10-22T07:39:25Z

Error: Invalid event hub notification url='<scrub>eventhub:///...'

URL Format used:

EventHub:https://[namespace].servicebus.windows.net/[eventhub-name]?tenantId=[tenant]

Please advise on next steps. Is this a known issue with specific Azure tenants or Event Hub configurations?

Thank you
MQ
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-22T08:51:24.25+00:00

Hi MQ,

Thanks for checking everything and sharing the request IDs that’s really helpful. From your details, this looks like Graph isn’t able to validate the Event Hub endpoint, even though your setup appears correct.

Let’s confirm a couple of things that often resolve this:

1.Check the role assignment identity Run this in Azure CLI:

az ad sp show --id fcbbf149-8ca2-4f2a-96e4-8a12b37191ff --query "objectId" -o tsv

Then go to Access Control (IAM) on your Event Hub namespace and make sure the same objectId is listed under the Azure Event Hubs Data Sender role. Sometimes the role is assigned to the appId instead of the service principal objectId, and Graph can’t validate it.

2.Test with a new Shared Access Policy (Send permission) Create a temporary Send policy on the Event Hub and test again. If that works, it usually means the RBAC role hasn’t propagated fully yet.

3.Check the exact notification URL Make sure it matches exactly:

EventHub:https://<namespace>.servicebus.windows.net/<eventhub-name>?tenantId=<tenant-domain-or-id>

No trailing slashes, and try both the tenant domain and GUID.

4.If all checks pass and it still fails This might be a backend validation issue on Microsoft Graph’s side. Please open a support case and share these details:

Request IDs and UTC times (which you already provided)

The subscription body (minus secrets)

Confirmation that the correct service principal objectId has the Data Sender role

That info lets the Graph team trace the validation call internally.

Let’s try the identity check first and see if that resolves it.

Thanks,
Manoj
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-23T08:59:03.9933333+00:00

Hi MQ,
We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.

Thanks,
Manoj
Manoj Kumar Boyini 19,590 Reputation points Microsoft External Staff Moderator

2025-10-24T08:52:26.5766667+00:00

Hi MQ,

We hope the above steps were helpful. If you have any other questions, please feel free to contact us.

Thanks,
Manoj
MQ 0 Reputation points

2025-10-27T14:22:02.1+00:00

Hi Manoj,

Thank you for your continued support. I've completed all verification steps:

✅ Service Principal Object ID Verified:

Object ID: (removed)

RBAC role assigned at namespace level (confirmed via Azure CLI)

✅ SAS Policy Test Completed:

Created new SAS policy "GraphTest" with Send permission

Same ValidationError occurs with SAS (bypassing RBAC entirely)

✅ Configuration Confirmed 100% Correct:

EntityPath present in connection string

URL format exactly per Microsoft specification

Network access: Public, allow all

Tested with both tenant domain and GUID

❌ Result: ValidationError persists with both RBAC and SAS authentication

Latest Test Details:

Request ID: (removed)

UTC Time: 2025-10-27T14:13:31Z

Notification URL: EventHub:https://<namespace>.servicebus.windows.net/<eventhub-name>?tenantId=<tenant-domain-or-ID>

Error: Invalid event hub notification url='<scrub>eventhub:///4A3ECB4D3E4BA556117A3B01873573F4CFFD979AE42AD484415673E5BB945DFE</scrub>'

Since the error occurs identically with both RBAC and SAS (which completely bypasses RBAC), this appears to be a Microsoft Graph backend validation issue rather than a configuration problem.

I will open a support case as suggested.

Thank you,

MQ
Anonymous

2025-10-27T14:56:22.2833333+00:00

Hi MQ,

Thank you for detailed response, can you please provide the requested details over the private messaging. It will help us to proceed further. If you have already raised Support ticket, can you please share the Ticket ID with Us.

Thanks!

Kalyani