What authentication does the Azure Policy States API use?

It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs Reader on Microsoft.PolicyInsights at the queried scope. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.

Can I get a compliance summary at management group scope through this API?

Yes. POST to /providers/Microsoft.Management/managementGroups/{name}/providers/Microsoft.PolicyInsights/policyStates/latest/summarize. The response returns compliant and non-compliant resource counts aggregated across every subscription beneath the management group.

What are the rate limits for the Policy States API?

Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads per hour. Compliance state results can be large; use $top and $skiptoken pagination, and prefer summarize endpoints over queryResults when only counts are needed.

How do I list non-compliant resources through Jentic?

Run pip install jentic and search for 'list non-compliant Azure resources'. Jentic returns the policyStates 'latest' queryResults operation; load its schema and execute it with $filter=complianceState eq 'NonCompliant' at the desired scope.

What is the difference between latest and a date-pinned policyStates resource?

policyStates/latest returns the most recent evaluation result for each resource and is what dashboards typically query. Date-pinned values like policyStates/default return the state as recorded for a particular evaluation cycle, useful for reproducing a historical snapshot or investigating a specific evaluation.

Can I limit what my agent is allowed to do with the Azure Policy States API?

Yes. Because you run Jentic One yourself, your own rules decide which of this API's operations the agent may call, so you can allow only querying current compliance state or summarizing counts and leave everything else out. Scope lives in the URL path here (subscription, management group, policy assignment, or policy definition), so you can grant a subscription-scope summarize while withholding a management-group summarize the agent has no reason to run. The Azure AD credential is held by your own instance and injected only for the operations you permit, never exposed to the agent.