🕓Policies history

How this log is built

This derived log compares consecutive catalogue snapshots. The refresh is scheduled daily at 06:00 UTC; weekly snapshot and manual runs can also refresh it. A scheduled collection is not a guarantee that Azure changed that day, nor a real-time feed. Event dates are detection times, not publication dates.

Added means present in the new scan but absent from the previous catalogue; Removed means the reverse. These observations do not establish Microsoft's exact publication or retirement date.

Modified records changes to name, category, effect, mode, version or definition type. Expand an event to compare the stored values. Previous rule JSON, parameters and descriptions are not recorded here. A version change alone cannot explain a behavioral change or the impact on your assignments; even an effect change needs assessment in its assignment context.

Recording starts with the collector, without backfilling earlier Azure history. The first scan establishes a baseline. The retention limit is 180 days at each refresh; a shared limit of 3,000 policy and initiative events can shorten that window. No retained event is not evidence of no historical change, and untracked rule-only changes may not appear.

Counts describe the active filters across all matching events, not only the displayed batch. The total retained count covers policy events only. Recent-period filters use UTC calendar days ending today; all retained events remain available regardless of the age of the last refresh.

Export includes every matching event with its recorded fields, active filters and source timestamp, not just the visible batch. It does not reconstruct missing values. Inspect the source log (policies and initiatives).