Microsoft Azure PolicyEventsClient

Name: PolicyEventsClient API
Brand: Azure Policy Events
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityComplianceoauth29 EndpointsREST

Install Jentic One Beta

Connect the PolicyEventsClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PolicyEventsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PolicyEventsClient API.

Query policy evaluation events at subscription scope across all assignments

Filter events by time range, compliance state, or policy assignment ID

Retrieve events for a single resource to investigate when it became non-compliant

GET STARTED

Start building with PolicyEventsClient API

Explore with Jentic

View OpenAPI Document

For Agents

Query the historical stream of Azure Policy evaluation events at any scope (management group, subscription, resource group, resource, assignment, definition) through 9 OData query endpoints.

Use for: I need to retrieve the last 30 days of policy events for a subscription, Find every event where a resource became non-compliant with the tag policy, List all policy events for a single virtual machine, Filter events by policyAssignmentId for our 'allowed-locations' assignment

Not supported: Does not author policies, manage assignments, or report current compliance state - use for querying the historical stream of policy evaluation events only.

Use Cases

Patterns agents use PolicyEventsClient API for, with concrete tasks.

★ Compliance Drift Investigation

Investigate why a resource is currently flagged non-compliant. Query policy events at the resource scope, filter to the relevant policy assignment, and order by timestamp to see the exact change that flipped the resource from compliant to non-compliant. The events include the operation that triggered evaluation, so the audit trail points back at the deployment, the user or service principal that ran it, and the diff between expected and actual values.

Query policy events for resource '/subscriptions/{id}/resourceGroups/web/providers/Microsoft.Web/sites/app1', filter to NonCompliant events in the last 14 days, and order by timestamp descending

Tenant-Wide Compliance Reporting

Build a tenant-level compliance report by querying events at management group scope. Group events by subscription, by policy assignment, and by compliance state to produce a board-ready summary of non-compliance hotspots. The OData $apply support enables aggregation server-side so the agent does not have to pull every event row.

Query policy events at management group scope for the last 30 days, group by policyAssignmentId and complianceState, and return a sorted list of the top 10 assignments by NonCompliant count

Policy Change Validation

After updating a policy definition or assignment, validate that the change is being evaluated correctly. Query events filtered to the assignment, look at evaluations that have occurred since the change took effect, and confirm the expected resources flipped state. This catches regressions where a policyRule update produced different results than intended before they spread across the estate.

Query policy events filtered by policyAssignmentId='/subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/require-tags' since the assignment update timestamp and report compliance counts

AI Agent Compliance Investigator

An AI agent supporting a security or governance team can investigate compliance events through Jentic. The agent searches by intent ('query azure policy events'), Jentic returns the queryResults operation with its OData filter schema, and the agent executes the call with managed Azure credentials. The same flow handles drift investigation, change validation, and tenant-wide reporting without the agent learning the seven scope variants of the events endpoint.

Search Jentic for 'query Azure policy events for a resource', load the queryResults schema, and execute it for the supplied resource ID with a 14-day window

Key Endpoints

9 endpoints — jentic publishes the only available openapi specification for policyeventsclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at subscription scope

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at resource group scope

POST

/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific resource

POST

/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at management group scope

POST

/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyAssignments/{policyAssignmentName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific policy assignment

POST

/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyDefinitions/{policyDefinitionName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific policy definition

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at subscription scope

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at resource group scope

POST

/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific resource

POST

/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at management group scope

POST

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'query Azure policy events for a resource' or 'find non-compliant policy events', and Jentic returns the matching scope-specific queryResults operation with its input schema so the agent does not pick between the scope variants by hand.

Time to first call

FAQs

Specific to using PolicyEventsClient API through Jentic.

Why is there no official OpenAPI spec for PolicyEventsClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PolicyEventsClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Azure Policy Events API use?

It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs Reader on Microsoft.PolicyInsights at the queried scope. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.

Can I filter events by policy assignment through this API?

Yes. POST to /subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/{name}/providers/Microsoft.PolicyInsights/policyEvents/default/queryResults with an OData $filter on timestamp and complianceState in the request body. The response includes the resource ID, evaluation result, and the policy definition that fired.

What are the rate limits for the Policy Events API?

Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads per hour. Event queries can return large result sets; use $top and $skiptoken pagination for windows wider than a few hours to stay under per-call response size limits.

How do I investigate a non-compliant resource through Jentic?

Run pip install jentic and search for 'query azure policy events for a resource'. Jentic returns the queryResults operation; load its schema and execute it with the resource ID, a 14-day timestamp filter, and complianceState eq 'NonCompliant'.

How far back does this API retain policy events?

Azure Policy events are retained for 30 days. For longer-term compliance history, export events to Log Analytics or Storage via diagnostic settings on the Microsoft.PolicyInsights resource provider.

Can I limit what my agent is allowed to do with the Azure Policy Events API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent can use, and this API encodes the scope directly in the URL path, so you can grant only the queryResults operation you need, such as querying policy events at a single subscription scope. If you do not add the management-group query operation, the agent cannot walk events across all child subscriptions. The event filters, like a timestamp range or a complianceState value, still travel in the request body, so you control both the operation and the breadth of access from your own instance.

Microsoft Azure PolicyEventsClient

Connect the PolicyEventsClient to your agent

Capabilities

Start building with PolicyEventsClient API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs