Event Grid: Unable to Save New Filter — Validation Endpoint Issue

Question

Event Grid: Unable to Save New Filter — Validation Endpoint Issue

Fredrik Mohlin 0

Problem description

I am trying to add or update filters on existing Event Grid system subscriptions within a specific resource group and system topic. When attempting to save the new filter, I encounter an error related to webhook endpoint validation failing. The issue began on October 22, 2026. The save operation does not produce a detailed error message, but the portal displays a validation failure. I want to understand why the validation is failing during the update process.

Environment

Azure Event Grid system topic in the resource group. The affected subscriptions are blob event topics.

What I've already tried

The issue occurs when attempting to save filters via the Azure portal. No changes have been successfully saved since the problem started.

Current status

I am seeking guidance on diagnosing and resolving the webhook validation failure during filter updates on Event Grid subscriptions. I want to identify the root cause and steps to fix the validation issue to successfully update the filters.

Tejaswini Billakurthi 770 Reputation points Microsoft External Staff Moderator

2026-10-22T16:51:32.2+00:00
Hello @Fredrik Mohlin ,

Thank you for reaching out to Microsoft Q & A !

I understand that you're trying to add or update filters on existing Event Grid system topic subscriptions for Blob Storage events. Since October 22, 2026, saving the change in the Azure portal fails with a webhook endpoint validation error.

Cause: This is expected Event Grid behavior. Any change to a subscription, including a filter-only change, counts as an update. When an event subscription is created or updated, Event Grid sends a subscription validation event to the target webhook endpoint. If the endpoint doesn't complete this handshake, the update fails, even though the filter itself is valid.

For the handshake to succeed, the endpoint must:

Return the validationCode in a validationResponse property with HTTP 200 OK. HTTP 202 Accepted isn't accepted.

Respond within 30 seconds. Event Grid retries once after 5 seconds. If all attempts fail, it's treated as a validation handshake error.

Common reasons the handshake fails:

The endpoint doesn't echo back the validation code, or doesn't return 200 OK.

A firewall, Application Gateway or WAF in front of the endpoint blocks the request and returns 403 Forbidden.

The subscription uses the CloudEvents v1.0 schema, and the endpoint doesn't respond to the HTTP OPTIONS validation request with the WebHook-Allowed-Origin header.

The endpoint uses a self-signed certificate, which isn't supported.

Resolution:

Test the endpoint. Send a sample SubscriptionValidationEvent to your webhook URL:

curl -X POST -H "Content-Type: application/json" -H "aeg-event-type: SubscriptionValidation" \

-d '[{"id":"aaaa0000-bb11-2222-33cc-444444dddddd","topic":"/subscriptions/xxxx","subject":"","data":{"validationCode":"aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"},"eventType":"Microsoft.EventGrid.SubscriptionValidationEvent","eventTime":"2018-01-25T22:12:19.4556811Z","metadataVersion":"1","dataVersion":"1"}]' \ https://<your-webhook-url>

The expected response is HTTP 200 with:{ "validationResponse": "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e" }

If you get 403 Forbidden: Check whether the endpoint sits behind an Application Gateway or WAF. If it does, review these rules: 920300, 942430, 920230, 942130 and 931130.

If the endpoint is an Azure Function with an HTTP trigger: Consider switching the endpoint type from Web Hook to Azure Function with an Event Grid trigger, because Event Grid validates Event Grid triggers automatically. If the function is protected with Microsoft Entra ID, you'll need to keep the webhook approach.

If the endpoint can't return the code synchronously: Use the manual handshake. Return HTTP 200, then send a GET request to the validationUrl from the event data within 10 minutes. This URL uses port 553, so make sure your firewall allows it.

Check recent changes: Since this started on October 22, check whether anything changed on the endpoint around that date. Examples are a deployment, function key rotation, enabling App Service authentication, network or WAF rule changes, or a certificate renewal.

If the issue continues, please share the full error message and HTTP status code from the Activity log of the failed update (with the endpoint URL and keys masked), so we can look into it further.

References:

Endpoint validation with Event Grid event schema

Troubleshoot Event Grid subscription validation failures

Use a function as an event handler for Event Grid events

Hope this helps. If you have any more questions, please let me know .

If this answer is helpful, please click "Upvote" so others in the community with a similar question can find it.
Fredrik Mohlin 0 Reputation points

2026-10-23T09:04:54.3233333+00:00

..........
Fredrik Mohlin 0 Reputation points

2026-10-26T07:47:49.7066667+00:00

Hello @Tejaswini Billakurthi

When I curl the POST request I get 401 Unauthorized. The webhook is protected with Microsoft Entra authentication (app Company Name Webhook, same tenant). I can't get a valid token myself, because the endpoint only accepts tokens whose oid is the Microsoft.EventGrid service principal.

Event delivery works. Blob-created events reach the endpoint with a bearer token and get 200 OK. Only saving changes fails.

The user saving the subscription has Default Access on the webhook app's service principal. The app's only role, WebhookSubscriber, allows Application members only.

While it started 22 October I do not recall when we last tried to add or update filters on existing Event Grid system topic subscriptions for Blob Storage events.

2 answers

Your answer

Fredrik Mohlin 0 Reputation points

2026-10-23T09:04:54.3233333+00:00

..........
Fredrik Mohlin 0 Reputation points

2026-10-26T07:47:49.7066667+00:00

Hello @Tejaswini Billakurthi

When I curl the POST request I get 401 Unauthorized. The webhook is protected with Microsoft Entra authentication (app Company Name Webhook, same tenant). I can't get a valid token myself, because the endpoint only accepts tokens whose oid is the Microsoft.EventGrid service principal.

Event delivery works. Blob-created events reach the endpoint with a bearer token and get 200 OK. Only saving changes fails.

The user saving the subscription has Default Access on the webhook app's service principal. The app's only role, WebhookSubscriber, allows Application members only.

While it started 22 October I do not recall when we last tried to add or update filters on existing Event Grid system topic subscriptions for Blob Storage events.

Answer 1

Fredrik Mohlin 0

Solved this by assigning permissions to an unrelated Storage account. Very strange.

0 comments

Answer 2

Hi Fredrik Mohlin & thx for join me at Q&A platform,

One important detail here is that Azure Event Grid can perform webhook endpoint validation when an event subscription is updated, not just when it's created. So even if you're only changing filters, the update can fail if Event Grid can't complete the validation handshake with the existing endpoint.

I'd first check whether the webhook is still reachable and responding correctly to validation requests. For the Event Grid event schema, the endpoint must handle Microsoft.EventGrid.SubscriptionValidationEvent and return HTTP 200 with the received validationCode in the validationResponse property. Returning HTTP 202 or a normal event-processing response isn't enough.

If you're using CloudEvents instead, validation works differently. The endpoint must handle the HTTP OPTIONS request and return the appropriate WebHook-Allowed-Origin header.

Check the webhook's application logs around the exact time you click Save. Look for incoming validation requests and their HTTP status codes. A 401, 403, timeout, or missing validation response would explain the failure. If there's a firewall, WAF, API gateway, or authentication layer in front of the webhook, check whether it's rejecting those requests.

I'd also look at Azure Activity Log for the failed Microsoft.EventGrid/eventSubscriptions/write operation. The detailed error response and correlation ID should help distinguish an actual endpoint validation failure from a portal or resource provider issue.

Because this started on October 22 and affects existing subscriptions, there's another possibility worth checking: the Azure portal might be submitting endpoint configuration during the filter update, causing validation to run again. That's not necessarily a bug, but if the endpoint responds correctly and the update still fails, I'd want Microsoft to investigate that path.

As a diagnostic, compare the current subscription configuration with the update request and check whether the destination endpoint or authentication settings are being changed unintentionally. You could also try updating only the filters through Azure CLI or ARM, while preserving the existing endpoint configuration. I'd do that on a non-production subscription first if possible.

If the same operation fails outside the portal, it points more toward Event Grid validation or the resource provider. If CLI/ARM succeeds while the portal fails, that would be useful evidence of a portal-specific issue.

I wouldn't recommend deleting and recreating the production event subscriptions just to get around this. what's the destination endpoint type a custom HTTPS webhook, Azure Function, Logic App, or something else? And are the existing subscriptions still delivering blob events successfully? That would help narrow down whether we're dealing with a webhook handshake problem or an unexpected validation failure during the subscription update.

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer

Fredrik Mohlin 0 Reputation points

2026-10-23T15:46:06.97+00:00

Hi @Alex Burlachenko

Yes the destination endpoint type is a custom HTTPS webhook and that endpoint handles Microsoft.EventGrid.SubscriptionValidationEvent.

else if (eventData is SubscriptionValidationEventData subscriptionValidationEventData) { var response = new SubscriptionValidationResponse { ValidationResponse = subscriptionValidationEventData.ValidationCode }; return TypedResults.Ok(response); }

Regarding the logs, I can see error 401 in application insights when I curl a post request but I do not see the attempted saves. I can also see error 405 from opening webhook url in browser.

No Event Grid validation request from the failed prod saves ever reached the app. Event Grid fails before sending anything it seems.

Existing subscriptions still deliver blob events.

The webhook uses Microsoft Entra ID authentication

The Activity Log error shows an empty StatusCode. Webhook endpoint validation failed for /subscriptions/.../resourceGroups/.../providers/Microsoft.EventGrid/systemTopics/...blobevent-topic/eventSubscriptions/...blobevent-topic. Status: Failed, StatusCode: , Response:

Some correlation ids

1be08e66-fb3e-4e64-b809-a9af8f1e97f8

28b0dc27-1941-432f-b3e5-0af9531ffcae

bc4c4070-4ce6-4d2b-bf8c-0287e33e4ac9

c119fdc4-a6a0-4d5b-bbb6-59f5d77568f7

Thanks in advance