PolicyEventsClient

Name: PolicyEventsClient API
Brand: Azure Policy Events
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityComplianceoauth29 EndpointsREST

For Agents

Query the historical stream of Azure Policy evaluation events at any scope (management group, subscription, resource group, resource, assignment, definition) through 9 OData query endpoints.

Connect the PolicyEventsClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PolicyEventsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PolicyEventsClient API.

Query policy evaluation events at subscription scope across all assignments

Filter events by time range, compliance state, or policy assignment ID

Retrieve events for a single resource to investigate when it became non-compliant

Query events scoped to a specific policy definition or policy set definition

GET STARTED

Start building with PolicyEventsClient API

Explore with Jentic

View OpenAPI Document

Use for: I need to retrieve the last 30 days of policy events for a subscription, Find every event where a resource became non-compliant with the tag policy, List all policy events for a single virtual machine, Filter events by policyAssignmentId for our 'allowed-locations' assignment

Not supported: Does not author policies, manage assignments, or report current compliance state — use for querying the historical stream of policy evaluation events only.

Jentic publishes the only available OpenAPI document for PolicyEventsClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for PolicyEventsClient, keeping it validated and agent-ready. The Azure Policy Insights events API exposes 9 query endpoints under Microsoft.PolicyInsights for retrieving the historical stream of policy evaluation events. Use it to query events at management group, subscription, resource group, individual resource, policy assignment, policy definition, or policy set definition scope, with OData filters for time range, compliance state, and policy identifiers — the audit log behind every Azure Policy compliance state change.

Use Cases

Patterns agents use PolicyEventsClient API for, with concrete tasks.

★ Compliance Drift Investigation

Investigate why a resource is currently flagged non-compliant. Query policy events at the resource scope, filter to the relevant policy assignment, and order by timestamp to see the exact change that flipped the resource from compliant to non-compliant. The events include the operation that triggered evaluation, so the audit trail points back at the deployment, the user or service principal that ran it, and the diff between expected and actual values.

Query policy events for resource '/subscriptions/{id}/resourceGroups/web/providers/Microsoft.Web/sites/app1', filter to NonCompliant events in the last 14 days, and order by timestamp descending

Tenant-Wide Compliance Reporting

Build a tenant-level compliance report by querying events at management group scope. Group events by subscription, by policy assignment, and by compliance state to produce a board-ready summary of non-compliance hotspots. The OData $apply support enables aggregation server-side so the agent does not have to pull every event row.

Query policy events at management group scope for the last 30 days, group by policyAssignmentId and complianceState, and return a sorted list of the top 10 assignments by NonCompliant count

Policy Change Validation

After updating a policy definition or assignment, validate that the change is being evaluated correctly. Query events filtered to the assignment, look at evaluations that have occurred since the change took effect, and confirm the expected resources flipped state. This catches regressions where a policyRule update produced different results than intended before they spread across the estate.

Query policy events filtered by policyAssignmentId='/subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/require-tags' since the assignment update timestamp and report compliance counts

AI Agent Compliance Investigator

An AI agent supporting a security or governance team can investigate compliance events through Jentic. The agent searches by intent ('query azure policy events'), Jentic returns the queryResults operation with its OData filter schema, and the agent executes the call with managed Azure credentials. The same flow handles drift investigation, change validation, and tenant-wide reporting without the agent learning the seven scope variants of the events endpoint.

Search Jentic for 'query Azure policy events for a resource', load the queryResults schema, and execute it for the supplied resource ID with a 14-day window

Key Endpoints

9 endpoints — jentic publishes the only available openapi specification for policyeventsclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at subscription scope

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at resource group scope

POST

/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific resource

POST

/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at management group scope

POST

/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyAssignments/{policyAssignmentName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific policy assignment

POST

/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyDefinitions/{policyDefinitionName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific policy definition

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at subscription scope

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at resource group scope

POST

/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events for a specific resource

POST

/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults

Query policy events at management group scope

POST

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure service principal credentials are encrypted in the Jentic vault. Agents receive scoped ARM bearer tokens at execution time and never see the underlying client secret.

Intent-based discovery

Agents search by intent ('query azure policy events for a resource' or 'find non-compliant policy events') and Jentic returns the matching scope-specific queryResults operation, avoiding the need to pick between the seven scope variants manually.

Time to first call

Direct ARM integration: half a day for AAD app registration, MSAL token handling, and OData filter construction. Through Jentic: under 30 minutes.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure Policy States

Query current compliance state instead of the historical event stream.

Use Policy States for 'what is non-compliant right now'; use Policy Events for 'when did this become non-compliant'.

Complementary

Azure Policy

Author and assign the policies whose evaluation history this API exposes.

Use Policy to define and assign policies; use Policy Events to investigate their historical effects.

Complementary

Azure Policy Tracked Resources

List resources modified by deployIfNotExists or modify policies.

Use Tracked Resources to inspect what remediation deployments produced; use Events to inspect evaluation history.

Alternative

Azure Monitor

Generic activity log queries that include policy evaluations alongside other ARM activity.

Choose Monitor for cross-cutting activity searches; choose Policy Events for purpose-built policy queries.

FAQs

Specific to using PolicyEventsClient API through Jentic.

Why is there no official OpenAPI spec for PolicyEventsClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PolicyEventsClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Azure Policy Events API use?

It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs Reader on Microsoft.PolicyInsights at the queried scope. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.

Can I filter events by policy assignment through this API?

Yes. POST to /subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/{name}/providers/Microsoft.PolicyInsights/policyEvents/default/queryResults with an OData $filter on timestamp and complianceState in the request body. The response includes the resource ID, evaluation result, and the policy definition that fired.

What are the rate limits for the Policy Events API?

Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads per hour. Event queries can return large result sets; use $top and $skiptoken pagination for windows wider than a few hours to stay under per-call response size limits.

How do I investigate a non-compliant resource through Jentic?

Run pip install jentic and search for 'query azure policy events for a resource'. Jentic returns the queryResults operation; load its schema and execute it with the resource ID, a 14-day timestamp filter, and complianceState eq 'NonCompliant'.

How far back does this API retain policy events?

Azure Policy events are retained for 30 days. For longer-term compliance history, export events to Log Analytics or Storage via diagnostic settings on the Microsoft.PolicyInsights resource provider.