0
# Policy Events Operations
1

2
## Overview
3

4
Policy Events operations enable querying policy evaluation events across different Azure scopes. These operations provide detailed information about policy evaluations, including when they occurred and their results.
5

6
## Core Functionality
7

8
### Query Operations
9

10
#### list_query_results_for_management_group
11

12
```python
13
def list_query_results_for_management_group(
14
    management_group_name: str,
15
    query_options: Optional[QueryOptions] = None,
16
    **kwargs
17
) -> ItemPaged[PolicyEvent]
18
```
19
{ .api }
20

21
Query policy events for a management group.
22

23
**Parameters:**
24
- `management_group_name`: Management group name
25
- `query_options`: Optional query parameters (top, filter, orderby, select, from, to, apply)
26

27
**Returns:** Paginated collection of PolicyEvent objects
28

29
#### list_query_results_for_subscription
30

31
```python
32
def list_query_results_for_subscription(
33
    subscription_id: str,
34
    query_options: Optional[QueryOptions] = None,
35
    **kwargs
36
) -> ItemPaged[PolicyEvent]
37
```
38
{ .api }
39

40
Query policy events for a subscription.
41

42
**Parameters:**
43
- `subscription_id`: Azure subscription ID
44
- `query_options`: Optional query parameters
45

46
**Returns:** Paginated collection of PolicyEvent objects
47

48
#### list_query_results_for_resource_group
49

50
```python
51
def list_query_results_for_resource_group(
52
    subscription_id: str,
53
    resource_group_name: str,
54
    query_options: Optional[QueryOptions] = None,
55
    **kwargs
56
) -> ItemPaged[PolicyEvent]
57
```
58
{ .api }
59

60
Query policy events for a resource group.
61

62
**Parameters:**
63
- `subscription_id`: Azure subscription ID
64
- `resource_group_name`: Resource group name
65
- `query_options`: Optional query parameters
66

67
**Returns:** Paginated collection of PolicyEvent objects
68

69
#### list_query_results_for_resource
70

71
```python
72
def list_query_results_for_resource(
73
    resource_id: str,
74
    query_options: Optional[QueryOptions] = None,
75
    **kwargs
76
) -> ItemPaged[PolicyEvent]
77
```
78
{ .api }
79

80
Query policy events for a specific resource.
81

82
**Parameters:**
83
- `resource_id`: Full Azure resource ID
84
- `query_options`: Optional query parameters
85

86
**Returns:** Paginated collection of PolicyEvent objects
87

88
#### list_query_results_for_policy_set_definition
89

90
```python
91
def list_query_results_for_policy_set_definition(
92
    subscription_id: str,
93
    policy_set_definition_name: str,
94
    query_options: Optional[QueryOptions] = None,
95
    **kwargs
96
) -> ItemPaged[PolicyEvent]
97
```
98
{ .api }
99

100
Query policy events for a policy set definition.
101

102
**Parameters:**
103
- `subscription_id`: Azure subscription ID
104
- `policy_set_definition_name`: Policy set definition name
105
- `query_options`: Optional query parameters
106

107
**Returns:** Paginated collection of PolicyEvent objects
108

109
#### list_query_results_for_policy_definition
110

111
```python
112
def list_query_results_for_policy_definition(
113
    subscription_id: str,
114
    policy_definition_name: str,
115
    query_options: Optional[QueryOptions] = None,
116
    **kwargs
117
) -> ItemPaged[PolicyEvent]
118
```
119
{ .api }
120

121
Query policy events for a policy definition.
122

123
**Parameters:**
124
- `subscription_id`: Azure subscription ID
125
- `policy_definition_name`: Policy definition name
126
- `query_options`: Optional query parameters
127

128
**Returns:** Paginated collection of PolicyEvent objects
129

130
#### list_query_results_for_subscription_level_policy_assignment
131

132
```python
133
def list_query_results_for_subscription_level_policy_assignment(
134
    subscription_id: str,
135
    policy_assignment_name: str,
136
    query_options: Optional[QueryOptions] = None,
137
    **kwargs
138
) -> ItemPaged[PolicyEvent]
139
```
140
{ .api }
141

142
Query policy events for a subscription-level policy assignment.
143

144
**Parameters:**
145
- `subscription_id`: Azure subscription ID
146
- `policy_assignment_name`: Policy assignment name
147
- `query_options`: Optional query parameters
148

149
**Returns:** Paginated collection of PolicyEvent objects
150

151
#### list_query_results_for_resource_group_level_policy_assignment
152

153
```python
154
def list_query_results_for_resource_group_level_policy_assignment(
155
    subscription_id: str,
156
    resource_group_name: str,
157
    policy_assignment_name: str,
158
    query_options: Optional[QueryOptions] = None,
159
    **kwargs
160
) -> ItemPaged[PolicyEvent]
161
```
162
{ .api }
163

164
Query policy events for a resource group-level policy assignment.
165

166
**Parameters:**
167
- `subscription_id`: Azure subscription ID
168
- `resource_group_name`: Resource group name
169
- `policy_assignment_name`: Policy assignment name
170
- `query_options`: Optional query parameters
171

172
**Returns:** Paginated collection of PolicyEvent objects
173

174
## Related Types
175

176
### PolicyEvent
177

178
```python
179
class PolicyEvent:
180
    additional_properties: Optional[Dict[str, Any]]
181
    odata_id: Optional[str]
182
    odata_context: Optional[str]
183
    timestamp: Optional[datetime.datetime]
184
    resource_id: Optional[str]
185
    policy_assignment_id: Optional[str]
186
    policy_definition_id: Optional[str]
187
    effective_parameters: Optional[str]
188
    is_compliant: Optional[bool]
189
    subscription_id: Optional[str]
190
    resource_type: Optional[str]
191
    resource_location: Optional[str]
192
    resource_group: Optional[str]
193
    resource_tags: Optional[str]
194
    policy_assignment_name: Optional[str]
195
    policy_assignment_owner: Optional[str]
196
    policy_assignment_parameters: Optional[str]
197
    policy_assignment_scope: Optional[str]
198
    policy_definition_name: Optional[str]
199
    policy_definition_action: Optional[str]
200
    policy_definition_category: Optional[str]
201
    policy_set_definition_id: Optional[str]
202
    policy_set_definition_name: Optional[str]
203
    policy_set_definition_owner: Optional[str]
204
    policy_set_definition_category: Optional[str]
205
    policy_set_definition_parameters: Optional[str]
206
    management_group_ids: Optional[str]
207
    policy_definition_reference_id: Optional[str]
208
    tenant_id: Optional[str]
209
    principal_oid: Optional[str]
210
    components: Optional[List[ComponentEventDetails]]
211
```
212
{ .api }
213

214
### ComponentEventDetails
215

216
```python
217
class ComponentEventDetails:
218
    id: Optional[str]
219
    type: Optional[str]
220
    name: Optional[str]
221
    timestamp: Optional[datetime.datetime]
222
    tenant_id: Optional[str]
223
    principal_oid: Optional[str]
224
    policy_definition_action: Optional[str]
225
    additional_properties: Optional[Dict[str, Any]]
226
```
227
{ .api }
228

229
### PolicyEventsQueryResults
230

231
```python
232
class PolicyEventsQueryResults:
233
    odata_context: Optional[str]
234
    odata_count: Optional[int]
235
    odata_next_link: Optional[str]
236
    value: Optional[List[PolicyEvent]]
237
```
238
{ .api }
239

240
## Usage Examples
241

242
### Query Recent Policy Events
243

244
```python
245
from datetime import datetime, timedelta
246

247
# Query policy events from the last 24 hours
248
yesterday = datetime.utcnow() - timedelta(days=1)
249
query_options = QueryOptions(
250
    filter=f"timestamp ge {yesterday.isoformat()}Z",
251
    top=50,
252
    orderby="timestamp desc"
253
)
254

255
events = client.policy_events.list_query_results_for_subscription(
256
    subscription_id=subscription_id,
257
    query_options=query_options
258
)
259

260
for event in events:
261
    print(f"Event: {event.timestamp} - {event.resource_id} - Compliant: {event.is_compliant}")
262
```
263

264
### Query Events for Specific Policy
265

266
```python
267
# Query events for a specific policy definition
268
policy_events = client.policy_events.list_query_results_for_policy_definition(
269
    subscription_id=subscription_id,
270
    policy_definition_name="my-policy-definition",
271
    query_options=QueryOptions(top=100)
272
)
273

274
for event in policy_events:
275
    print(f"Resource: {event.resource_id}")
276
    print(f"Action: {event.policy_definition_action}")
277
    print(f"Compliant: {event.is_compliant}")
278
    print(f"Timestamp: {event.timestamp}")
279
    print("---")
280
```
281

282
### Monitor Non-Compliant Events
283

284
```python
285
# Query only non-compliant events
286
query_options = QueryOptions(
287
    filter="isCompliant eq false",
288
    orderby="timestamp desc",
289
    select="timestamp,resourceId,policyDefinitionName,policyDefinitionAction"
290
)
291

292
non_compliant_events = client.policy_events.list_query_results_for_resource_group(
293
    subscription_id=subscription_id,
294
    resource_group_name="production-rg",
295
    query_options=query_options
296
)
297

298
print("Non-compliant policy events:")
299
for event in non_compliant_events:
300
    print(f"- {event.timestamp}: {event.resource_id} failed {event.policy_definition_name}")
301
```
302

303
### Paginate Through Events
304

305
```python
306
# Handle pagination manually
307
events_iterator = client.policy_events.list_query_results_for_subscription(
308
    subscription_id=subscription_id,
309
    query_options=QueryOptions(top=10)  # Small page size for demonstration
310
)
311

312
page_count = 0
313
event_count = 0
314

315
for event in events_iterator:
316
    event_count += 1
317
    if event_count % 10 == 1:  # New page
318
        page_count += 1
319
        print(f"Page {page_count}:")
320
    
321
    print(f"  Event {event_count}: {event.resource_id}")
322
    
323
    # Break after processing a reasonable number
324
    if event_count >= 50:
325
        break
326
```