Azure Event Grid MQTT broker over private delivery

Updated 27 October 2026

Cellular devices can use the Azure Event Grid MQTT broker without the internet: private delivery brings their traffic into your virtual network, and the Event Grid namespace accepts connections from private endpoints only. Microsoft documents the setting in Configure private endpoints for Event Grid namespaces with MQTT.

Status: Coming soon (checked 26 October 2026) · Notify me when available

What the broker offers

From Microsoft’s MQTT broker overview:

Steps

1. Deliver SIM traffic into the virtual network: see private delivery into Azure.
2. In the namespace networking settings, choose “Private endpoints only” for public network access, then add a private endpoint in a subnet of that network.
3. DNS: Microsoft’s private endpoint DNS reference lists privatelink.ts.eventgrid.azure.net for namespace topic spaces (the MQTT side). Answer device queries from that zone, for example through an Azure DNS Private Resolver inbound endpoint used as the private APN’s DNS server.
4. Register clients with their certificates in the namespace client registry, and define topic spaces and permission bindings.
5. Test with one SIM: the broker host name must resolve to the private endpoint address.

Design notes for cellular devices

• QoS 1 with retries is the reliable choice, since QoS 2 is not available.
• Keep messages small: cellular data is billed by volume, and the 1 MB ceiling is far above typical telemetry.
• Session expiry (MQTT v5) lets a device that sleeps in PSM between reports keep its subscriptions, or drop them on purpose.
• Reconnect with the same session name. Microsoft recommends static session names: an offline persistent session still counts against the namespace’s limit of sessions per client (MQTT support details).

The SIMs: IoT SIM cards. Device management on Azure: IoT Hub over private delivery.