You need to onboard thousands of IoT devices that publish and subscribe over MQTT using a cloud-native broker. Each device must be restricted to a topic subtree that includes its own device ID. You also want to define topic patterns once and apply them to all devices. What should you configure?

The correct answer is to create an Event Grid namespace and enable the MQTT broker, then define a topic space with variables and assign client permissions. This approach directly addresses all requirements: Event Grid namespaces provide a cloud-native MQTT broker, topic spaces allow defining patterns like devices/{clientId}/, and client permissions ensure each device is restricted to its specific topic subtree using its client ID. Azure IoT Hub is primarily for device management and telemetry ingestion, not a general-purpose MQTT broker for arbitrary topic patterns and fine-grained access control across thousands of custom topics. Service Bus topics do not inherently support MQTT protocol for direct device communication or the fine-grained, variable-based topic access control needed. Azure Event Hubs with Kafka endpoints are for high-throughput event streaming, not an MQTT broker, and Kafka ACLs are not designed for per-device MQTT topic subtree restrictions. Event Grid subscriptions are for routing events, not for acting as an MQTT broker or managing device publish/subscribe permissions.