When you create an Event Grid subscription that points at your HTTPS webhook, the endpoint receives a handshake before any real events arrive. What must the endpoint do to prove it controls the URL?
Show answer and explanation
Answer: B
Event Grid confirms ownership of a webhook by sending a SubscriptionValidationEvent when the subscription is created. The aeg-event-type header identifies the request type, and the event data includes a validationCode that the endpoint must echo back in a validationResponse, or it can complete a validation URL instead. Only after this handshake succeeds does Event Grid deliver real events. Secure ongoing delivery separately, for example with Microsoft Entra ID-based delivery or a hard-to-guess path token, rather than relying on the handshake alone.
Why the other options are wrong
- A. Event Grid does not send a shared secret in an Authorization header during the handshake. Requiring a header the service never sends would reject the legitimate validation request.
- C. Event Grid delivers from many endpoints and IP ranges change, so IP allow-listing does not prove ownership of the subscription URL. It also does not confirm the subscriber controls the endpoint.
- D. No such toggle is required before the handshake starts. Event Grid sends the validation event automatically when the subscription is created, and the endpoint must answer it.