Microsoft Azure PolicyTrackedResourcesClient

What authentication does the Azure Policy Tracked Resources API use?

It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs Reader on Microsoft.PolicyInsights at the queried scope. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.

Can I see which resources were created by a specific deployIfNotExists assignment?

Yes. POST to /subscriptions/{id}/providers/Microsoft.PolicyInsights/policyTrackedResources/default/queryResults with $filter=policyAssignmentId eq '{assignmentId}' in the OData query. The response lists each resource created or modified by that assignment along with the originating evaluation timestamp.

What are the rate limits for the Policy Tracked Resources API?

Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads per hour. Tracked resource queries can return large result sets; use $top and $skiptoken pagination for environments with hundreds of remediations.

How do I audit policy remediations through Jentic?

Run pip install jentic and search for 'list Azure policy tracked resources'. Jentic returns the queryResults operation; load its schema and execute it at the desired scope with optional $filter on policyAssignmentId or timestamp.

Does this API include resources affected by audit-effect policies?

No. Tracked resources covers deployIfNotExists and modify effects, which create or change resources. Audit, deny, and append effects are not in scope here. For audit-effect compliance state use PolicyStatesClient; for evaluation history use PolicyEventsClient.

Can I limit what my agent is allowed to do with the Azure Policy Tracked Resources API?

Yes. Because you self-host Jentic One, your own rules decide which of the four queryResults operations the agent may call, and this API carries its scope in the URL path, so you can grant only the operation you need, such as querying tracked resources at a resource group scope. A subscription-wide or management group query is not available to the agent unless you explicitly add that operation. Jentic One injects your Azure AD credential at execution time under those same rules, so the agent can read tracked resources only at the scopes you allow.