Skip to main content

policy_events

Creates, updates, deletes, gets or lists a policy_events resource.

Overview​

Namepolicy_events
TypeResource
Idazure.policy_insights.policy_events

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
@odataobject
complianceStatestringCompliance state of the resource.
componentsarrayComponents events records populated only when URL contains $expand=components clause.
effectiveParametersstringEffective parameters for the policy assignment.
isCompliantbooleanFlag which states whether the resource is compliant against the policy assignment it was evaluated against.
managementGroupIdsstringComma separated list of management group IDs, which represent the hierarchy of the management groups the resource is under.
policyAssignmentIdstringPolicy assignment ID.
policyAssignmentNamestringPolicy assignment name.
policyAssignmentOwnerstringPolicy assignment owner.
policyAssignmentParametersstringPolicy assignment parameters.
policyAssignmentScopestringPolicy assignment scope.
policyDefinitionActionstringPolicy definition action, i.e. effect.
policyDefinitionCategorystringPolicy definition category.
policyDefinitionIdstringPolicy definition ID.
policyDefinitionNamestringPolicy definition name.
policyDefinitionReferenceIdstringReference ID for the policy definition inside the policy set, if the policy assignment is for a policy set.
policySetDefinitionCategorystringPolicy set definition category, if the policy assignment is for a policy set.
policySetDefinitionIdstringPolicy set definition ID, if the policy assignment is for a policy set.
policySetDefinitionNamestringPolicy set definition name, if the policy assignment is for a policy set.
policySetDefinitionOwnerstringPolicy set definition owner, if the policy assignment is for a policy set.
policySetDefinitionParametersstringPolicy set definition parameters, if the policy assignment is for a policy set.
principalOidstringPrincipal object ID for the user who initiated the resource operation that triggered the policy event.
resourceGroupstringResource group name.
resourceIdstringResource ID.
resourceLocationstringResource location.
resourceTagsstringList of resource tags.
resourceTypestringResource type.
subscriptionIdstringSubscription ID.
tenantIdstringTenant ID for the policy event record.
timestampstring (date-time)Timestamp for the policy event record.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
list_query_results_for_resource_group_level_policy_assignmentselectsubscription_id, resource_group_name, policy_events_resource, policy_assignment_name$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the resource group level policy assignment.
list_query_results_for_resource_groupselectsubscription_id, resource_group_name, policy_events_resource$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the resources under the resource group.
list_query_results_for_policy_set_definitionselectsubscription_id, policy_events_resource, policy_set_definition_name$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the subscription level policy set definition.
list_query_results_for_policy_definitionselectsubscription_id, policy_events_resource, policy_definition_name$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the subscription level policy definition.
list_query_results_for_subscription_level_policy_assignmentselectsubscription_id, policy_events_resource, policy_assignment_name$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the subscription level policy assignment.
list_query_results_for_management_groupselectpolicy_events_resource, management_group_name$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the resources under the management group.
list_query_results_for_subscriptionselectsubscription_id, policy_events_resource$top, $orderby, $select, $from, $to, $filter, $apply, $skiptokenQueries policy events for the resources under the subscription.
list_query_results_for_resourceselectpolicy_events_resource, resource_id$top, $orderby, $select, $from, $to, $filter, $apply, $expand, $skiptokenQueries policy events for the resource.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
management_group_namestringManagement group name. Required.
policy_assignment_namestringPolicy assignment name. Required.
policy_definition_namestringPolicy definition name. Required.
policy_events_resourcestringThe name of the virtual resource under PolicyEvents resource type; only "default" is allowed. "default" Required.
policy_set_definition_namestringPolicy set definition name. Required.
resource_group_namestringThe name of the resource group. The name is case insensitive. Required.
resource_idstringResource ID. Required.
subscription_idstringThe ID of the target subscription. The value must be an UUID. Required.
$applystringOData apply expression for aggregations. Default value is None.
$expandstringThe $expand query parameter. For example, to expand components use $expand=components. Default value is None.
$filterstringOData filter expression. Default value is None.
$fromstring (date-time)ISO 8601 formatted timestamp specifying the start time of the interval to query. When not specified, the service uses ($to - 1-day). Default value is None.
$orderbystringOrdering expression using OData notation. One or more comma-separated column names with an optional "desc" (the default) or "asc", e.g. "$orderby=PolicyAssignmentId, ResourceId asc". Default value is None.
$selectstringSelect expression using OData notation. Limits the columns on each record to just those requested, e.g. "$select=PolicyAssignmentId, ResourceId". Default value is None.
$skiptokenstringSkiptoken is only provided if a previous response returned a partial result as a part of nextLink element. Default value is None.
$tostring (date-time)ISO 8601 formatted timestamp specifying the end time of the interval to query. When not specified, the service uses request time. Default value is None.
$topintegerMaximum number of records to return. Default value is None.

SELECT examples​

Queries policy events for the resource group level policy assignment.

SELECT
@odata,
complianceState,
components,
effectiveParameters,
isCompliant,
managementGroupIds,
policyAssignmentId,
policyAssignmentName,
policyAssignmentOwner,
policyAssignmentParameters,
policyAssignmentScope,
policyDefinitionAction,
policyDefinitionCategory,
policyDefinitionId,
policyDefinitionName,
policyDefinitionReferenceId,
policySetDefinitionCategory,
policySetDefinitionId,
policySetDefinitionName,
policySetDefinitionOwner,
policySetDefinitionParameters,
principalOid,
resourceGroup,
resourceId,
resourceLocation,
resourceTags,
resourceType,
subscriptionId,
tenantId,
timestamp
FROM azure.policy_insights.policy_events
WHERE subscription_id = '{{ subscription_id }}' -- required
AND resource_group_name = '{{ resource_group_name }}' -- required
AND policy_events_resource = '{{ policy_events_resource }}' -- required
AND policy_assignment_name = '{{ policy_assignment_name }}' -- required
AND $top = '{{ $top }}'
AND $orderby = '{{ $orderby }}'
AND $select = '{{ $select }}'
AND $from = '{{ $from }}'
AND $to = '{{ $to }}'
AND $filter = '{{ $filter }}'
AND $apply = '{{ $apply }}'
AND $skiptoken = '{{ $skiptoken }}'
;