Support for "Consumer Group" scoped access to Event Hubs resources?

[kesane-msft]

Is your question related to a specific version? If so, please specify:

Python: 3.12.10
Function Runtime Version: 4.1041.200.25360

What binding does your question apply to, if any? (e.g. Blob Trigger, Event Hub Binding, etc)

Event Hub Binding

Question

I have an Azure Function which is triggered whenever an event is received on the EventHub.
The function has a managed identity (UMI) associated with it which is used to authorize the access on the EventHub.

Event Hubs support Azure role assignment at Consumer Group or Event Hub or Namespace level.
https://learn.microsoft.com/en-us/azure/event-hubs/authorize-access-azure-active-directory#resource-scope

However, if I assign Azure Functions UMI the "Azure Event Hubs Data Receiver" role at the Consumer Group level, then the Azure function fails with error Unauthorized access. 'Listen' claim(s) are required to perform this operation
If I just assign the same UMI access the "Azure Event Hubs Data Receiver" role at the Event Hub level, it works fine.

So, my question is -

1. Are role assignments at Consumer Group level supported with Event Hub Triggers and Python?
2. If yes, are there some additional arguments needed in the trigger?
3. If not, any plans to support them?

[hallvictoria]

Hi @kesane-msft, thanks for reporting.

1. The scope of the role assignment can be for an Event Hubs namespace, or the event hub itself. Role assignments at the Consumer Group level aren't supported.
2. n/a
3. There are no plans for this right now. If there are plans in the future, I'll re-open and update this issue.