Event Grid Subscription Validation Handler

Overview

This flow is a reusable, compliant Azure Event Grid webhook receiver, deployed as a Power Automate cloud flow. An HTTP-triggered flow acts as the endpoint: it completes the Event Grid subscription validation handshake (echoing the validationCode), enforces a topic allowlist, logs every validated event to a Dataverse audit table with a correlation id, resolves a per-eventType downstream handler, and returns HTTP 200.

Why it matters: Event Grid requires a one-time validation handshake before it will deliver to any webhook endpoint. Getting the handshake, schema parsing, and acknowledgement right once gives you a robust, portable receiver for any custom Event Grid integration.

Ships Off (demo).

Use Case

A developer or IT admin needs a Power Automate endpoint that Azure Event Grid can deliver to directly via webhook - for example, to react to Azure resource changes, Blob events, or custom topic events without standing up an Azure Function. This flow provides the compliant receiver: it answers the validation challenge, screens events against a trusted-topic allowlist, persists an auditable record of each accepted event, and routes events to named handlers.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Topic allowlist

Set the allowed topics to a comma-separated list of trusted topic scopes to reject events from any other source. Leave empty to accept all.

Handler routing

Populate the handler map with JSON like {"Microsoft.Storage.BlobCreated":"ingest"} and replace the Resolve Handler Route Compose with a Switch to branch into real downstream actions.

CloudEvents v1.0

To support the CloudEvents schema, detect the OPTIONS/Webhook-Request-Origin handshake and parse type/source/subject instead of eventType/topic/subject.

Shared-secret auth

Require a secret header on the trigger (e.g. aeg-sas-key or a custom header) and validate it before processing.

Downstream dispatch

Replace the Compose handlers with real connector actions (Teams post, queue message, child-flow call) keyed off the resolved route.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@equals(triggerBody()?[0]?['eventType'], 'Microsoft.EventGrid.SubscriptionValidationEvent')

@triggerBody()?[0]?['data']?['validationCode']

@coalesce(json(variables('varHandlerMap'))?[items('Dispatch_Validated_Events')?['eventType']], 'default')