Azure events

Latest Dynatrace
How-to guide
Published Apr 27, 2026

Enable Azure Event Grid system topic event forwarding

Azure Event Grid system topics capture resource lifecycle events—such as blob creation and deletion, resource group changes, and service health alerts— from Azure services. To forward these events to Dynatrace, create an event subscription on a system topic that routes events to the dt-events-evh Event Hub deployed by the ARM template.

Azure automatically creates system topics for supported services when you first subscribe to their events. If no system topic exists yet for a resource, it will be created as part of step 3 below.

Configure an event subscription

In the Azure Portal, go to the resource from which you want to capture events (for example, a Storage Account or a Resource Group).
Select Events from the left menu.
Select + Event Subscription.
Enter a name for the event subscription.
Under Event Types, select the event types you want to forward (for example, Blob Created, Blob Deleted, Resource Write Success).
Under Endpoint type, select Event Hub.
Select Select an endpoint and choose the Event Hub namespace deployed by the ARM template in the same region as the resource. For Event Hub, select dt-events-evh.
Select Create.

Repeat this for each resource or resource type from which you want to capture events.

Configure event subscriptions at scale Recommended

Manually configuring event subscriptions for each resource is impractical at scale. Azure Policy allows you to automatically enforce event subscription configuration across all resources of a given type.

In the Azure Portal, go to Policy > Definitions and search for built-in policies with the pattern Configure Event Grid subscription on <service>.
Select the appropriate policy for your resource type.
Select Assign.
Scope the assignment to the desired Subscription or Management Group.
Under Parameters, set the Event Hub resource ID to the dt-events-evh Event Hub deployed by the ARM template.
Enable the Create a remediation task option to apply the policy to existing resources immediately.
Select Review + create then Create.

Use an Azure Policy Initiative (policy set) to group multiple event subscription policies and assign them together across your environment.

Query Azure events in Notebooks

You can query Azure events ingested via Dynatrace using Notebooks and DQL.

Use the dt.da.source attribute to filter for events ingested through the Azure events ingest pipeline.

fetch events
| filter dt.da.source == "azure-event-ingest"
| sort timestamp desc