Subscribe to Azure Storage Blob Lifecycle Policy Events

I believe LifecyclePolicyCompleted is not an Audit Log event, rather an event grid system topic you can subscribe to:

• https://azurefeeds.com/2024/08/07/subscribe-to-azure-storage-blob-lifecycle-policy-events/

• https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/event-grid/event-schema-blob-storage.md

Sample script:
param ( [string]$subscriptionId = "XXXXX-XXX-XXX-XXX-XXXXX", [string]$resourceGroupName = "YOUR-RG", [array]$excludedStorageAccounts = @("SOME-EXCLUDED-STORAGE-ACCOUNT"), [string]$userAssignedIdentity = "/subscriptions/XXXXX-XXX-XXX-XXX-XXXXX/resourcegroups/MY-RG/providers/microsoft.managedidentity/userassignedidentities/MY-MANAGED-IDENTITY", [string]$eventEndpoint = "/subscriptions/XXXXX-XXX-XXX-XXX-XXXXX/resourceGroups/MY-RG/providers/Microsoft.Storage/storageAccounts/MY-STORAGE-ACCOUNT/queueServices/default/queues/MY-QUEUE" )

$ErrorActionPreference = "Stop"

Select-AzSubscription -SubscriptionId $subscriptionId

$storageAccounts = Get-AzStorageAccount -ResourceGroupName $resourceGroupName

$filteredStorageAccounts = $storageAccounts | Where-Object { $excludedStorageAccounts -notcontains $_.StorageAccountName }

Write-Host "Starting loop to create Event Grid System Topics and Subscriptions"

foreach ($storageAccount in $filteredStorageAccounts) {

*$systemTopicName = "lifecycle-$($storageAccount.StorageAccountName)"*

*$resourceId = $storageAccount.Id*

*Write-Host "Creating Event Grid System Topic for storage account: $($storageAccount.StorageAccountName)"*

*New-AzEventGridSystemTopic -ResourceGroupName $resourceGroupName `*

                           *-Name $systemTopicName `*

                           *-Location $storageAccount.Location `*

                           *-Source $resourceId `*

                           *-UserAssignedIdentity $userAssignedIdentity `*

                           *-TopicType "Microsoft.Storage.StorageAccounts"*

*Write-Host "Creating Event Grid Subscription for system topic: $systemTopicName"*

*$destination = New-AzEventGridStorageQueueEventSubscriptionDestinationObject -QueueName "storageevents" -ResourceId $eventEndpoint*

*New-AzEventGridSubscription -Name "lcmmonitor" `*

                            *-DeliveryWithResourceIdentityDestination $destination `*

                            *-FilterIncludedEventType @("Microsoft.Storage.BlobCreated", "Microsoft.Storage.BlobDeleted", "Microsoft.Storage.BlobTierChanged", "Microsoft.Storage.LifecyclePolicyCompleted", "Microsoft.Storage.AsyncOperationInitiated") `*

                            *-Scope $resourceId `*

                            *-DeliveryWithResourceIdentityType UserAssigned `*

                            *-DeliveryWithResourceIdentityUserAssignedIdentity $userAssignedIdentity*

}