Send Policy Gateway events to an Azure Log Analytics workspace via the Data Collector API.
| Field | Value |
|---|
| Type | Azure Monitor |
| Workspace ID | From Azure Portal → Log Analytics workspace → Agents |
| Shared Key | Primary or secondary key from the same Agents page |
| Log Type | Custom log table name. Default PolicyGatewayAudit |
https://<workspace_id>.ods.opinsights.azure.com/api/logs.
Event shape
Events arrive as rows in the custom log table (suffixed _CL by Log Analytics):
{
"TimeGenerated": "2026-04-20T18:30:00Z",
"event_id_s": "3d14a2b8-...",
"event_type_s": "enforcement",
"policy_id_s": "support-bot",
"decision_s": "refuse",
"effective_decision_s": "allow",
"enforced_b": false,
"rollout_mode_s": "shadow",
"reason_code_s": "REFUSE",
"policy_target_s": "chat.completions",
"project_id_s": "proj_support_bot",
"model_s": "abliterated-model"
}
_s for strings, _b for booleans, _d for numbers, _t for datetimes.)
Query
PolicyGatewayAudit_CL
| where decision_s == "refuse" and enforced_b == true
| summarize count() by reason_code_s, bin(TimeGenerated, 1h)
Last modified on April 21, 2026
