0

My current query is:

policyresources 
| where type =~ 'microsoft.policyinsights/policystates'
| extend
    policyDefinitionId = tostring(properties.policyDefinitionId),
    policyAssignmentScope = tostring(properties.policyAssignmentScope),
    policyAssignmentName = tostring(properties.policyAssignmentName)
| project policyDefinitionId, policyAssignmentScope, policyAssignmentName
| join kind=leftouter (
    policyresources
    | where type =~ "microsoft.authorization/policydefinitions"
    | extend 
    description = tostring(properties.description),
    displayName = tostring(properties.displayName)
    | where displayName contains 'deprecated'
    | project id, description, displayName
    ) on $left.policyDefinitionId == $right.id

But I just get "An unexpected query execution error occurred. Please try again later. (Code:UnexpectedQueryExecutionError)". What I am doing wrong here and how could I get the information I need?

Kamsiinov
  • 1,315
  • 2
  • 20
  • 50
  • Have you tried it again later? The query does show output when I run it so it might be a transient error. – Peter Bons Aug 23 '23 at 15:00
  • I started to try this yesterday. I am guessing it might be because there is ~20 million policystates in the tenant which makes the join too heavy. – Kamsiinov Aug 23 '23 at 15:42

0 Answers0