Azure Event Grid Domain Creation: Overcoming AZ CLI's TLS Parameter Limitations with Workaround

Introduction: The Intersection of Security Policies and DevOps Automation

In the modern cloud landscape, organizations increasingly enforce strict security requirements through platform policies. One common requirement is mandating latest TLS versions for example TLS 1.2 across all deployed resources to protect data in transit. While this is an excellent security practice, it can sometimes conflict with the available configuration options in deployment tools, particularly in the Azure CLI.

This blog explores a specific scenario that many Azure DevOps teams encounter: how to deploy an Azure Event Grid domain when your organization has a custom policy requiring latest version considering TLS 1.2, but the Azure CLI command doesn't provide a parameter to configure this setting.

The Problem: Understanding the Gap Between Policy and Tooling

What Is Azure Event Grid?

Azure Event Grid is a serverless event routing service that enables event-driven architectures. It manages the routing of events from various sources (like Azure services, custom applications, or SaaS products) to different handlers such as Azure Functions, Logic Apps, or custom webhooks.

An Event Grid domain provides a custom topic endpoint that can receive events from multiple sources, offering a way to organize and manage events at scale.

The Policy Requirement:

Many organizations implement Azure Policy to enforce security standards across their cloud infrastructure. A common policy might look like this:

 

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.EventGrid/domains"
        },
        {
          "anyOf": [
            {
              "field": "Microsoft.EventGrid/domains/minimumTlsVersion",
              "exists": false
            },
            {
              "field": "Microsoft.EventGrid/domains/minimumTlsVersion",
              "notEquals": "1.2"
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

This policy blocks the creation of any Event Grid domain that doesn't explicitly set TLS 1.2 as the minimum TLS version.

The CLI Limitation:

Now, let's examine the Azure CLI command to create an Event Grid domain:

az eventgrid domain | Microsoft Learn

TLS property is unrecognized with the latest version of AZ CLI version.

Current Status of This Limitation:

It's worth noting that this limitation has been recognized by the Azure team. There is an official GitHub feature request tracking this issue, which you can find at =>  Please add TLS support while creation of Azure Event Grid domain through CLI · Issue #31278 · Azure/azure-cli 

Before implementing this workaround described in this article, I recommend checking the current status of this feature request. The Azure CLI is continuously evolving, and by the time you're reading this, the limitation might have been addressed.

However, as of April 2025, this remains a known limitation in the Azure CLI, necessitating the alternative approach outlined below. 

Why This Matters:

This limitation becomes particularly problematic in CI/CD pipelines or Infrastructure as Code (IaC) scenarios where you want to automate the deployment of Event Grid domain resources.

Workaround:

You can utilize below ARM template and deploy it through AZ CLI in your deployment pipeline as below:

 

Working ARM template:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "domainName": {
      "type": "string",
      "metadata": {
        "description": "Name of the Event Grid Domain"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Azure region for the domain"
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.EventGrid/domains",
      "apiVersion": "2025-02-15",
      "name": "[parameters('domainName')]",
      "location": "[parameters('location')]",
      "properties": {
        "minimumTlsVersionAllowed": "1.2"
      }
    }
  ]
}

 

 

Please note I've used latest API version from below official Microsoft documentation :

Microsoft.EventGrid/domains - Bicep, ARM template & Terraform AzAPI reference | Microsoft Learn

 

Working AZ CLI command:

az deployment group create --resource-group <rg> --template-file <armtemplate.json> --parameters domainName=<event grid domain name>

 

You can store this ARM template in your configuration directory with replacement for Azure CLI command. It explicitly sets TLS 1.2 for Event Grid domains, ensuring security compliance where the CLI lacks this parameter. 

 

For example:

az deployment group create --resource-group <rg> --template-file ./config/<armtemplate.json> --parameters domainName=<event grid domain name>

Disclaimer:

The sample scripts provided in this article are provided AS IS without warranty of any kind. The author is not responsible for any issues, damages, or problems that may arise from using these scripts. Users should thoroughly test any implementation in their environment before deploying to production. Azure services and APIs may change over time, which could affect the functionality of the provided scripts. Always refer to the latest Azure documentation for the most up-to-date information.

 

Thanks for reading this blog! I hope you've found this workaround valuable for addressing the Event Grid domain TLS parameter limitation in Azure CLI.

 

                                                                                  😊