Azure DevOps部署ADF触发器遇EventGrid权限错误，求解决方案

我在Azure DevOps中通过YAML流水线部署Azure Data Factory，使用deploy-adf-json@2任务完成部署，流水线配置如下：

- task: deploy-adf-json@2
  inputs:
    azureSubscription: '<subscription name>'
    ResourceGroupName: '<rg name>'
    DatafactoryName: '<adf name>'
    ServicePath: '$(System.ArtifactsDirectory)/adf/linkedService'
    PipelinePath: '$(System.ArtifactsDirectory)/adf/pipeline'
    TriggerPath: '$(System.ArtifactsDirectory)/adf/trigger'
    Sorting: 'ascending'

部署后，除了名为Storage_Account_Trigger的触发器外，其余ADF组件均部署成功，该触发器返回如下错误：

##[error]Error deploying 'Storage_Account_Trigger' trigger : The client "client id" with object id "object id" has permission to perform action 'Microsoft.DataFactory/factories/triggers/write' on scope '/subscriptions/"subscription id"/resourceGroups/"rg name"/providers/Microsoft.DataFactory/factories/"adf name"/triggers/Storage_Account_Trigger'; however, it does not have permission to perform action(s) 'Microsoft.EventGrid/EventSubscriptions/Write' on the linked scope(s) '/subscriptions/"subscription id"/resourceGroups/"rg name"/providers/Microsoft.Storage/storageAccounts/"storage account name"' (respectively) or the linked scope(s) are invalid.

该触发器为BlobEventsTrigger，用于监控指定存储账户路径下的新CSV文件创建事件，触发PL_Ingest流水线，触发器JSON定义如下：

{
    "name": "Storage_Account_Trigger",
    "properties": {
        "annotations": [],
        "runtimeState": "Started",
        "pipelines": [
            {
                "pipelineReference": {
                    "referenceName": "PL_Ingest",
                    "type": "PipelineReference"
                }
            }
        ],
        "type": "BlobEventsTrigger",
        "typeProperties": {
            "blobPathBeginsWith": "<file path>",
            "blobPathEndsWith": ".csv",
            "ignoreEmptyBlobs": true,
            "scope": "/subscriptions/<subscription id>/resourceGroups/<rg name>/providers/Microsoft.Storage/storageAccounts/<storage account name>",
            "events": [
                "Microsoft.Storage.BlobCreated"
            ]
        }
    }
}

我无法修改存储账户的权限策略，且疑惑为何触发器需要写入权限——我仅需要监控文件创建事件，无需向存储账户写入内容。希望得到无需修改存储账户权限的解决方案，或解释权限需求的原因。

问题原因 #

BlobEventsTrigger依赖Azure Event Grid实现事件驱动：部署触发器时，ADF的服务主体需要在目标存储账户上创建Event Grid订阅，该操作要求服务主体拥有Microsoft.EventGrid/EventSubscriptions/Write权限——这不是对存储账户内容的写入权限，而是创建事件订阅的管理权限。

解决方案 #

方案1：改用轮询型BlobTrigger（无需Event Grid权限）

如果无法获取Event Grid订阅权限，可以替换为BlobTrigger（轮询模式），它通过定期扫描存储账户路径来检测新文件，仅需要存储账户的Storage Blob Data Reader权限。修改后的触发器示例如下：

{
    "name": "Storage_Account_Trigger",
    "properties": {
        "annotations": [],
        "runtimeState": "Started",
        "pipelines": [
            {
                "pipelineReference": {
                    "referenceName": "PL_Ingest",
                    "type": "PipelineReference"
                }
            }
        ],
        "type": "BlobTrigger",
        "typeProperties": {
            "folderPath": "<file path>",
            "fileName": "*.csv",
            "ignoreEmptyBlobs": true,
            "recurrence": {
                "frequency": "Minute",
                "interval": 5 // 按需调整轮询间隔
            },
            "scope": "/subscriptions/<subscription id>/resourceGroups/<rg name>/providers/Microsoft.Storage/storageAccounts/<storage account name>"
        }
    }
}

方案2：获取Event Grid订阅权限（若允许）

如果可以协调存储账户管理员配置权限，只需为ADF服务主体在存储账户级别添加EventGrid EventSubscription Contributor角色（或自定义仅包含Microsoft.EventGrid/EventSubscriptions/Write权限的角色），即可完成BlobEventsTrigger的部署。

内容的提问来源于stack exchange，提问作者Carolina Karoullas