You are recording purchase events from 100 retailers into Azure Event Hubs for a loyalty program. Each retailer has a unique identifier and can be added or removed at any time. Retailers must only be allowed to record events for themselves. How should you enable retailers to submit sales events securely?

Publisher policies in Azure Event Hubs are designed for scenarios where multiple independent publishers send events to the same Event Hub. They allow you to define a unique publisher name for each retailer and generate a Shared Access Signature (SAS) token specifically for that publisher. This ensures that each retailer can only send events using their assigned publisher name, preventing them from impersonating other retailers or sending events on their behalf. Creating a partition for each retailer is not a security mechanism; partitions are for scaling and parallel processing. While you could map retailers to partitions, it doesn't restrict a retailer from sending to another's partition if they have the right connection string. Defining a namespace for each retailer would be overly complex and expensive, as namespaces are high-level containers for Event Hubs, not for individual publishers within a single Event Hub.