System Topics

System topics are Event Grid topics that are automatically created and managed by Azure services. They represent events emitted by Azure resources — you don't create or manage the topic itself, you simply subscribe to the events you care about.

What Are System Topics?

When an Azure service (like Blob Storage or Key Vault) emits events, those events flow through a system topic. Azure manages the topic lifecycle — you only need to create an event subscription to start receiving events.

Prior to explicit system topic resources, subscriptions were created directly against the source resource. Now Azure also creates a visible Microsoft.EventGrid/systemTopics resource you can manage, monitor, and apply diagnostics to.

System Topics vs Custom Topics

Azure Services That Emit Events

Here is a comprehensive list of Azure services with Event Grid integration:

Detailed: Blob Storage Events

Blob Storage is the most commonly used event source. Events are emitted for General Purpose v2, BlobStorage, and BlockBlobStorage accounts.

Available Event Types

Example: Subscribe to Blob Events

# Subscribe to BlobCreated events in a specific storage account
az eventgrid event-subscription create \
  --name blob-created-sub \
  --source-resource-id "/subscriptions/{sub-id}/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorageacct" \
  --endpoint "https://my-func.azurewebsites.net/api/BlobHandler" \
  --included-event-types Microsoft.Storage.BlobCreated \
  --subject-begins-with "/blobServices/default/containers/images/"

Detailed: Key Vault Events

Key Vault events let you react to secret, key, and certificate lifecycle changes — critical for automated rotation and compliance.

Available Event Types

# Subscribe to secret expiry warnings
az eventgrid event-subscription create \
  --name keyvault-expiry-alerts \
  --source-resource-id "/subscriptions/{sub-id}/resourceGroups/my-rg/providers/Microsoft.KeyVault/vaults/my-vault" \
  --endpoint "https://my-func.azurewebsites.net/api/RotateSecret" \
  --endpoint-type webhook \
  --included-event-types Microsoft.KeyVault.SecretNearExpiry Microsoft.KeyVault.CertificateNearExpiry

Resource Group Events for Auditing

Subscribing to Resource Group events gives you a real-time audit trail of all resource changes:

# Subscribe to all write operations in a resource group
az eventgrid event-subscription create \
  --name rg-audit-log \
  --source-resource-id "/subscriptions/{sub-id}/resourceGroups/production-rg" \
  --endpoint "https://my-audit-api.azurewebsites.net/api/audit" \
  --included-event-types Microsoft.Resources.ResourceWriteSuccess Microsoft.Resources.ResourceDeleteSuccess

This captures who created, modified, or deleted any resource — useful for compliance and change tracking.

Discovering Available Events via CLI

# List all topic types (event source categories)
az eventgrid topic-type list --output table

# List event types for a specific service
az eventgrid topic-type list-event-types \
  --name Microsoft.Storage.StorageAccounts \
  --output table

# List event types for Key Vault
az eventgrid topic-type list-event-types \
  --name Microsoft.KeyVault.vaults \
  --output table

# List all system topics in your subscription
az eventgrid system-topic list --output table

# Show details of a specific system topic
az eventgrid system-topic show \
  --name my-storage-system-topic \
  --resource-group my-rg

Creating Explicit System Topics

While system topics are created implicitly when you add a subscription, you can create them explicitly for better management:

# Create an explicit system topic for a storage account
az eventgrid system-topic create \
  --name my-storage-topic \
  --resource-group my-rg \
  --location eastus \
  --topic-type Microsoft.Storage.StorageAccounts \
  --source "/subscriptions/{sub-id}/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorageacct"

# Then create a subscription on the system topic
az eventgrid system-topic event-subscription create \
  --name my-sub \
  --system-topic-name my-storage-topic \
  --resource-group my-rg \
  --endpoint "https://my-func.azurewebsites.net/api/handler" \
  --included-event-types Microsoft.Storage.BlobCreated

Benefits of explicit system topics:

• Visible in the portal as a dedicated resource
• Can apply diagnostic settings (logs and metrics)
• Easier to manage subscriptions in one place
• Supports managed identity for secure delivery

Monitoring System Topics in the Portal

In the Azure Portal, navigate to your system topic resource to see:

• Publish Success/Failure metrics — how many events the source emitted
• Delivery Success/Failure metrics — how many events reached handlers
• Matched/Unmatched events — events that did or didn't match any subscription filter
• Delivery latency — time between event publish and handler acknowledgment
• Dead-lettered events — events that failed all delivery attempts

You can also enable Diagnostic Settings to send metrics to Log Analytics, Event Hubs, or a Storage Account for long-term analysis.

Tips and Common Mistakes

• One system topic per source — Each Azure resource can have only one system topic. Multiple subscriptions share the same system topic
• Region matters — The system topic must be in the same region as the source resource
• Not using explicit system topics — Implicit topics work but are harder to monitor. Create explicit ones for production workloads
• Missing event types — Not all services emit events. Always check az eventgrid topic-type list-event-types before assuming a service supports Event Grid
• Forgetting to register the provider — Run az provider register --namespace Microsoft.EventGrid before creating system topics

Key Takeaways

• System topics represent events from Azure services — Azure manages the topic, you manage subscriptions
• Over 20 Azure services emit events through Event Grid system topics
• Blob Storage and Key Vault are the most commonly used event sources
• Resource Group events provide real-time audit trails for compliance
• Use az eventgrid topic-type list-event-types to discover available events for any service
• Create explicit system topics in production for better monitoring and diagnostics
• Each source resource can have only one system topic with multiple subscriptions