Once we have a Service Bus namespace in place, Azure Service Bus topics and subscriptions can be created through the portal at design time and in code at runtime (also using the Azure PowerShell console, but we're not covering that). This makes it possible to create everything up front, providing the subsystems with the design details, or have the individual subsystems provision their own messaging infrastructure.

Creating Service Bus components in-code has security implications, as in order to create queues and topics, an application needs to use the namespace Access Control Service (ACS) or Shared Access Signature (SAS) credentials. System administrators may not want production applications to have this kind of capability, so they don't lose control over the Service Bus infrastructure architecture. If these credentials are compromised, the whole namespace can be at risk of an attack. To create subscriptions in-code, we need the Manage permission on a SAS policy...