diagnostic-settings-category-group

Type: regulative

Decision

Diagnostic settings must enable logs by category group.

Why

Without category-group logging, diagnostic coverage depends on manually maintained category lists and can miss newly added log categories.

Violations

• Diagnostic settings enable individual log categories instead of a category group.

Anchor

no-unapproved-resources

Implements

• monitored

Files

• platform-management/policy/bicep/configDiagnosticSettings.bicep
• platform-management/policy/parameters/diagnosticSettings.bicepparam

← Back to knowledge graph