Microsoft Azure PolicyEventsClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentSecurityComplianceoauth29 EndpointsREST
For Agents
Query the historical stream of Azure Policy evaluation events at any scope (management group, subscription, resource group, resource, assignment, definition) through 9 OData query endpoints.
Use for: I need to retrieve the last 30 days of policy events for a subscription, Find every event where a resource became non-compliant with the tag policy, List all policy events for a single virtual machine, Filter events by policyAssignmentId for our 'allowed-locations' assignment
Not supported: Does not author policies, manage assignments, or report current compliance state — use for querying the historical stream of policy evaluation events only.
Jentic publishes the only available OpenAPI specification for PolicyEventsClient, keeping it validated and agent-ready. The Azure Policy Insights events API exposes 9 query endpoints under Microsoft.PolicyInsights for retrieving the historical stream of policy evaluation events. Use it to query events at management group, subscription, resource group, individual resource, policy assignment, policy definition, or policy set definition scope, with OData filters for time range, compliance state, and policy identifiers — the audit log behind every Azure Policy compliance state change.
Install Jentic One Beta
Connect the PolicyEventsClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PolicyEventsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with PolicyEventsClient API.
Query policy evaluation events at subscription scope across all assignments
Filter events by time range, compliance state, or policy assignment ID
Retrieve events for a single resource to investigate when it became non-compliant
Query events scoped to a specific policy definition or policy set definition
Aggregate event counts by compliance state for executive reporting
Walk events at management group scope for cross-subscription compliance audit
Inspect events for a specific policy assignment to validate that recent changes took effect
Use Cases
Patterns agents use PolicyEventsClient API for, with concrete tasks.
★ Compliance Drift Investigation
Investigate why a resource is currently flagged non-compliant. Query policy events at the resource scope, filter to the relevant policy assignment, and order by timestamp to see the exact change that flipped the resource from compliant to non-compliant. The events include the operation that triggered evaluation, so the audit trail points back at the deployment, the user or service principal that ran it, and the diff between expected and actual values.
Query policy events for resource '/subscriptions/{id}/resourceGroups/web/providers/Microsoft.Web/sites/app1', filter to NonCompliant events in the last 14 days, and order by timestamp descending
Tenant-Wide Compliance Reporting
Build a tenant-level compliance report by querying events at management group scope. Group events by subscription, by policy assignment, and by compliance state to produce a board-ready summary of non-compliance hotspots. The OData $apply support enables aggregation server-side so the agent does not have to pull every event row.
Query policy events at management group scope for the last 30 days, group by policyAssignmentId and complianceState, and return a sorted list of the top 10 assignments by NonCompliant count
Policy Change Validation
After updating a policy definition or assignment, validate that the change is being evaluated correctly. Query events filtered to the assignment, look at evaluations that have occurred since the change took effect, and confirm the expected resources flipped state. This catches regressions where a policyRule update produced different results than intended before they spread across the estate.
Query policy events filtered by policyAssignmentId='/subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/require-tags' since the assignment update timestamp and report compliance counts
AI Agent Compliance Investigator
An AI agent supporting a security or governance team can investigate compliance events through Jentic. The agent searches by intent ('query azure policy events'), Jentic returns the queryResults operation with its OData filter schema, and the agent executes the call with managed Azure credentials. The same flow handles drift investigation, change validation, and tenant-wide reporting without the agent learning the seven scope variants of the events endpoint.
Search Jentic for 'query Azure policy events for a resource', load the queryResults schema, and execute it for the supplied resource ID with a 14-day window
Key Endpoints
9 endpoints — jentic publishes the only available openapi specification for policyeventsclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events at subscription scope
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events at resource group scope
POST
/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events for a specific resource
POST
/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events at management group scope
POST
/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyAssignments/{policyAssignmentName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events for a specific policy assignment
POST
/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyDefinitions/{policyDefinitionName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events for a specific policy definition
POST
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events at subscription scope
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events at resource group scope
POST
/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events for a specific resource
POST
/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events at management group scope
POST
/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyAssignments/{policyAssignmentName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events for a specific policy assignment
POST
/subscriptions/{subscriptionId}/providers/{authorizationNamespace}/policyDefinitions/{policyDefinitionName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults
Query policy events for a specific policy definition
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure service principal credentials are encrypted in the Jentic vault. Agents receive scoped ARM bearer tokens at execution time and never see the underlying client secret.
Intent-based discovery
Agents search by intent ('query azure policy events for a resource' or 'find non-compliant policy events') and Jentic returns the matching scope-specific queryResults operation, avoiding the need to pick between the seven scope variants manually.
Time to first call
Direct ARM integration: half a day for AAD app registration, MSAL token handling, and OData filter construction. Through Jentic: under 30 minutes.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using PolicyEventsClient API through Jentic.
Why is there no official OpenAPI spec for PolicyEventsClient?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PolicyEventsClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Azure Policy Events API use?
It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs Reader on Microsoft.PolicyInsights at the queried scope. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.
Can I filter events by policy assignment through this API?
Yes. POST to /subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/{name}/providers/Microsoft.PolicyInsights/policyEvents/default/queryResults with an OData $filter on timestamp and complianceState in the request body. The response includes the resource ID, evaluation result, and the policy definition that fired.
What are the rate limits for the Policy Events API?
Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads per hour. Event queries can return large result sets; use $top and $skiptoken pagination for windows wider than a few hours to stay under per-call response size limits.
How do I investigate a non-compliant resource through Jentic?
Run pip install jentic and search for 'query azure policy events for a resource'. Jentic returns the queryResults operation; load its schema and execute it with the resource ID, a 14-day timestamp filter, and complianceState eq 'NonCompliant'.
How far back does this API retain policy events?
Azure Policy events are retained for 30 days. For longer-term compliance history, export events to Log Analytics or Storage via diagnostic settings on the Microsoft.PolicyInsights resource provider.
GET STARTED