Event Grid queue subscription fails destination validation although the queue exists

I am configuring Microsoft Defender for Storage malware-scan results to be delivered through an Event Grid custom topic to an Azure Storage Queue in UK South.

Problem:

Creating the Event Grid event subscription through Azure CLI failed with:

“Endpoint validation: Destination endpoint not found. Resource details: resourceId: <storage-account-resource-id>. Resource should pre-exist before attempting this operation.”

The destination storage account and queue both exist.

Checks completed:

• StorageV2 account in UK South.
• Queue existence check using --auth-mode login returns exists: true.
• ARM GET of the exact queue resource, API version 2023-05-01, returns its ID, name and type successfully.
• Event Grid custom topic provisioningState is Succeeded.
• Topic has a system-assigned managed identity.
• That identity has Storage Queue Data Message Sender assigned at the exact queue scope.
• Storage publicNetworkAccess is Enabled.
• Network defaultAction is Allow; bypass is AzureServices.
• Shared-key access is disabled and must remain disabled.
• Microsoft.EventGrid and Microsoft.Security providers are Registered.
• Defender on-upload malware scanning is enabled, with a 10 GB monthly cap.
• Defender configuration points to this custom scan-results topic.

I then tried a direct ARM PUT using Event Grid API version 2025-02-15 and this body:

{

"properties": {

"deliveryWithResourceIdentity": {

  "identity": {

    "type": "SystemAssigned"

  },

  "destination": {

    "endpointType": "StorageQueue",

    "properties": {

      "resourceId": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>",

      "queueName": "<queue-name>",

      "queueMessageTimeToLiveInSeconds": 604800

    }

  }

},

"filter": {

  "includedEventTypes": [

    "Microsoft.Security.MalwareScanningResult"

  ]

},

"eventDeliverySchema": "EventGridSchema"

}

}

The PUT returned provisioningState: Creating.

Activity Log:

• Original CLI attempt: Failed at 2026-10-05 11:58:43 UTC, with the endpoint-validation error.
• Direct ARM attempt: Started then Accepted at 2026-10-05 12:06:17 UTC.
• The activity-log checks performed afterwards showed no terminal status for the direct ARM attempt.

Subsequent GET requests to the same event-subscription ARM path return:

ResourceNotFound: Event subscription doesn't exist.

Questions:

1. Why does destination validation report the account missing when both account and queue resolve successfully through ARM?
2. Is queue-scoped Storage Queue Data Message Sender sufficient for managed-identity destination validation, or is another narrowly scoped permission required?
3. How can I retrieve the asynchronous operation’s final status when PUT returns Creating but GET returns ResourceNotFound?
4. Is this configuration supported with shared-key access disabled?

No files have been uploaded to test this route, and successful event delivery has not been demonstrated.