Another JSON for 'auditIfNotExists' Policy action. As it may be helpful
{
"authorization": {
"action": "Microsoft.Compute/virtualMachines/write",
"scope": "/subscriptions/763bb2f2-a98c-40d2-ba07-4db9629008de/resourcegroups/StorageAccounts_East_US/providers/Microsoft.Compute/virtualMachines/VM1"
},
"caller": "******@cbsg.edu.pl",
"channels": "Operation",
"claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/d9cc3696-4f92-4466-9437-3b8282f57802/",
"iat": "1674652550",
"nbf": "1674652550",
"exp": "1674657488",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"aio": "AVQAq/8TAAAAzIVCEihdHcUgHb9Jwz7a8/fT+ktoeKwWz8lvR7ZeqdzYjJrRAm1//ohryypzPMu7h5gKkZFX2F26oAqG0Zo4hnLwQsEo3ZsyQrtrul3xdek=",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
"appidacr": "2",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Mikolaj",
"groups": "f6490840-7d85-4ffb-b399-1dc5cbe662bb,81ce8e4c-09f8-4267-8669-b1abad0c22d5,11f19f4f-d97e-4b89-8fce-55983208deb9,5904fa81-d404-441b-a3e6-0ae16c4cc3ed,d6a64e82-149a-4ddb-b28a-c12b73184f0b",
"ipaddr": "85.128.61.130",
"name": "Mikolaj Pawelec",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "8ec62121-43b7-432a-bd2d-2eaddb65cf41",
"puid": "10032000EACA6CC0",
"rh": "0.AR8AljbM2ZJPZkSUNzuCgvV4AkZIf3kAutdPukPawfj2MBMfAPY.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "2v3tkvjSRoychoqrL32Dq3u6M68cvrzFeWL3VbT2OBA",
"http://schemas.microsoft.com/identity/claims/tenantid": "d9cc3696-4f92-4466-9437-3b8282f57802",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "******@cbsg.edu.pl",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "******@cbsg.edu.pl",
"uti": "mXAzYUw92E2Ku-LstEUFAA",
"ver": "1.0",
"xms_tcdt": "1510250105"
},
"correlationId": "98b01cf6-6b05-455a-a685-ebf4effd000a",
"description": "",
"eventDataId": "217870a7-6bdd-4abe-97c8-1b5f83c51676",
"eventName": {
"value": "EndRequest",
"localizedValue": "Koniec żądania"
},
"category": {
"value": "Policy",
"localizedValue": "Zasady"
},
"eventTimestamp": "2023-01-25T14:22:15.4501317Z",
"id": "/subscriptions/763bb2f2-a98c-40d2-ba07-4db9629008de/resourcegroups/StorageAccounts_East_US/providers/Microsoft.Compute/virtualMachines/VM1/events/217870a7-6bdd-4abe-97c8-1b5f83c51676/ticks/638102533354501317",
"level": "Error",
"operationId": "bfcf44e5-a000-4f5d-af03-aab202b03ecd",
"operationName": {
"value": "Microsoft.Authorization/policies/auditIfNotExists/action",
"localizedValue": "'auditIfNotExists' Policy action."
},
"resourceGroupName": "StorageAccounts_East_US",
"resourceProviderName": {
"value": "Microsoft.Compute",
"localizedValue": "Microsoft.Compute"
},
"resourceType": {
"value": "Microsoft.Compute/virtualMachines",
"localizedValue": "Microsoft.Compute/virtualMachines"
},
"resourceId": "/subscriptions/763bb2f2-a98c-40d2-ba07-4db9629008de/resourcegroups/StorageAccounts_East_US/providers/Microsoft.Compute/virtualMachines/VM1",
"status": {
"value": "Failed",
"localizedValue": "Niepowodzenie"
},
"subStatus": {
"value": "",
"localizedValue": ""
},
"submissionTimestamp": "2023-01-25T14:24:11.1701877Z",
"subscriptionId": "763bb2f2-a98c-40d2-ba07-4db9629008de",
"tenantId": "d9cc3696-4f92-4466-9437-3b8282f57802",
"properties": {
"isComplianceCheck": "False",
"resourceLocation": "eastus",
"ancestors": "d9cc3696-4f92-4466-9437-3b8282f57802",
"policies": "[{\"policyDefinitionId\":\"/providers/Microsoft.Authorization/policyDefinitions/5752e6d6-1206-46d8-8ab1-ecc2f71a8112\",\"policySetDefinitionId\":\"/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8\",\"policyDefinitionReferenceId\":\"windowsWebServersShouldBeConfiguredToUseSecureCommunicationProtocolsMonitoringEffect\",\"policySetDefinitionName\":\"1f3afdf9-d0c9-4c3d-847f-89da613e70a8\",\"policySetDefinitionDisplayName\":\"Azure Security Benchmark\",\"policySetDefinitionVersion\":\"57.0.0\",\"policyDefinitionName\":\"5752e6d6-1206-46d8-8ab1-ecc2f71a8112\",\"policyDefinitionDisplayName\":\"Windows web servers should be configured to use secure communication protocols\",\"policyDefinitionVersion\":\"4.1.0\",\"policyDefinitionEffect\":\"AuditIfNotExists\",\"policyAssignmentId\":\"/subscriptions/763bb2f2-a98c-40d2-ba07-4db9629008de/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn\",\"policyAssignmentName\":\"SecurityCenterBuiltIn\",\"policyAssignmentDisplayName\":\"ASC Default (subscription: 763bb2f2-a98c-40d2-ba07-4db9629008de)\",\"policyAssignmentScope\":\"/subscriptions/763bb2f2-a98c-40d2-ba07-4db9629008de\",\"policyAssignmentParameters\":{},\"policyAssignmentEnforcementMode\":\"Default\",\"policyExemptionIds\":[]}]",
"errorMessage": "The attempt to retrieve resources of type 'Microsoft.GuestConfiguration/guestConfigurationAssignments' for the 'AuditIfNotExists' policy resulted in a BadRequest response with error '{\"error\":{\"code\":\"NotFound\",\"message\":\"Exception occurred while trying to get VM information from the compute API. Exception: GuestConfiguration failed to get the compute information of the VM. Please ensure Microsoft.GuestConfiguration is registered RP inside the subscription.\"}}'.",
"eventCategory": "Policy",
"entity": "/subscriptions/763bb2f2-a98c-40d2-ba07-4db9629008de/resourcegroups/StorageAccounts_East_US/providers/Microsoft.Compute/virtualMachines/VM1",
"message": "Microsoft.Authorization/policies/auditIfNotExists/action",
"hierarchy": ""
},
"relatedEvents": []
}