🧠 Azure Subscription Activity Log Alert for Create or Update Policy Exemption does not exist - prod.logic.yaml🟢

Contextual name: 🧠 prod.logic.yaml🟢
ID: /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml
Tags:
- 🟢 Logic test success
- 🟢 Logic with extracts
- 🟢 Logic with test data

Uses

📗 Azure Subscription
🔌 Azure Activity Log Alert - object.extracts.yaml
🔌 Azure Subscription - object.extracts.yaml
🧪 test-data.json

Test Results 🟢

Generated at: 2026-11-14T12:03:39.853412905Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	create-or-update-policy-exemption-good	✔️ `199`	✔️ `CA10__Azure_Activity_Log_Alerts__r.has(COMPLIANT)`	✔️ `null`
🟢	create-or-update-policy-exemption-disabled	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	create-or-update-policy-exemption-wrong-operation	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	create-or-update-policy-exemption-extra-filter	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	create-or-update-policy-exemption-no-group	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	create-or-update-policy-exemption-broken-group	✔️ `299`	✔️ `CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)`	✔️ `null`
🟢	create-or-update-policy-exemption-unknown-state	✔️ `299`	✔️ `CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)`	✔️ `null`
🟢	create-or-update-policy-exemption-none	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	create-or-update-policy-exemption-mixed-good-unknown	✔️ `199`	✔️ `CA10__Azure_Activity_Log_Alerts__r.has(COMPLIANT)`	✔️ `null`
🟢	create-or-update-policy-exemption-mixed-bad-unknown	✔️ `299`	✔️ `CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)`	✔️ `null`
🟢	create-or-update-policy-exemption-deleted-alert	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	create-or-update-policy-exemption-narrow	✔️ `299`	✔️ `CA10__Azure_Activity_Log_Alerts__r.has(UNDETERMINED)`	✔️ `null`

Generation Bundle

	File	MD5
Open	`/ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/policy.yaml`	`950A8C7732F842FFA174D7B2807900BA`
Open	`/ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml`	`871EA19C6DC9B0DE597C895A6099A696`
Open	`/ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/test-data.json`	`2DA242FA5BEE3E6F92730FFD91DED45B`
Open	`/types/CA10__CaAzureActivityLogAlert__c/object.extracts.yaml`	`8A1FFCB1A6A450C933A1A1E63AD96EA2`
Open	`/types/CA10__CaAzureAccount__c/object.extracts.yaml`	`3FFDE42186EE2CD29391A3CBD86FC4C0`

Available Commands

repo-manager policies generate FULL /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption/prod.logic.yaml

Content

Open File

---
inputType: CA10__CaAzureAccount__c
testData:
  - file: test-data.json
conditions:
  - status: COMPLIANT
    currentStateMessage: An enabled subscription-wide create or update policy exemption alert has an action
      group.
    check:
      RELATED_LIST_HAS:
        relationshipName: CA10__Azure_Activity_Log_Alerts__r
        status: COMPLIANT
  - status: UNDETERMINED
    currentStateMessage: A candidate create or update policy exemption alert has unresolved scope or configuration.
    check:
      RELATED_LIST_HAS:
        relationshipName: CA10__Azure_Activity_Log_Alerts__r
        status: UNDETERMINED
otherwise:
  status: INCOMPLIANT
  currentStateMessage: No qualifying subscription-wide create or update policy exemption alert exists.
  remediationMessage: Create an enabled Administrative Microsoft.Authorization/policyExemptions/write
    alert covering the subscription, with an action group and no extra filters.
relatedLists:
  - relationshipName: CA10__Azure_Activity_Log_Alerts__r
    importExtracts:
      - file: /types/CA10__CaAzureActivityLogAlert__c/object.extracts.yaml
      - file: /types/CA10__CaAzureAccount__c/object.extracts.yaml
    conditions:
      - status: INAPPLICABLE
        currentStateMessage: This alert is disabled.
        check:
          IS_EQUAL:
            left:
              EXTRACT: CA10__enabledStatus__c
            right:
              TEXT: Disabled
      - status: UNDETERMINED
        currentStateMessage: The alert enablement state is unexpected.
        check:
          NOT:
            arg:
              IS_EQUAL:
                left:
                  EXTRACT: CA10__enabledStatus__c
                right:
                  TEXT: Enabled
      - status: INAPPLICABLE
        currentStateMessage: This alert does not cover the required unfiltered Administrative operation.
        check:
          NOT:
            arg:
              JSON_QUERY_BOOLEAN:
                arg:
                  EXTRACT: caJsonFrom__conditionJson__c
                expression: length(allOf) == `2` && length(allOf[?field=='category' && equals=='Administrative'])
                  == `1` && length(allOf[?field=='operationName' && equals=='Microsoft.Authorization/policyExemptions/write'])
                  == `1`
                undeterminedIf:
                  evaluationError: The collected JSON cannot be evaluated.
                  resultTypeMismatch: The JSON query did not return a boolean.
      - status: INAPPLICABLE
        currentStateMessage: This alert is scoped to a different subscription.
        check:
          NOT:
            arg:
              CONTAINS:
                arg:
                  EXTRACT: CA10__scopes__c
                search:
                  EXTRACT: CA10__subscription__r.CA10__subscriptionId__c
      - status: UNDETERMINED
        currentStateMessage: The alert scope needs manual review for subscription-wide coverage.
        check:
          NOT:
            arg:
              AND:
                args:
                  - STARTS_WITH:
                      arg:
                        EXTRACT: CA10__scopes__c
                      search:
                        TEXT: /subscriptions/
                  - ENDS_WITH:
                      arg:
                        EXTRACT: CA10__scopes__c
                      search:
                        EXTRACT: CA10__subscription__r.CA10__subscriptionId__c
                  - IS_EQUAL:
                      left:
                        SIZE:
                          arg:
                            SET_FROM:
                              arg:
                                EXTRACT: CA10__scopes__c
                              separator: /
                      right:
                        NUMBER: 2
      - status: COMPLIANT
        currentStateMessage: This alert covers the operation across the subscription and has an action
          group.
        check:
          RELATED_LIST_HAS:
            relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
            status: COMPLIANT
      - status: UNDETERMINED
        currentStateMessage: The configured action group cannot be resolved.
        check:
          RELATED_LIST_HAS:
            relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
            status: UNDETERMINED
    otherwise:
      status: INAPPLICABLE
      currentStateMessage: This alert has no current action group.
    relatedLists:
      - relationshipName: CA10Z1__Azure_Activity_Log_Alert_Action_Gr_Links__r
        conditions:
          - status: COMPLIANT
            currentStateMessage: The alert action group is resolved.
            check:
              NOT_EMPTY_LOOKUP: CA10Z1__actionGroup__r
        otherwise:
          status: UNDETERMINED
          currentStateMessage: The configured alert action group is unavailable.

Uses​

Test Results 🟢​

Generation Bundle​

Available Commands​

Content​

Uses

Test Results 🟢

Generation Bundle

Available Commands

Content