{
    "properties": {
        "displayName": "Audit authorization rules on Event Hub namespaces",
        "mode": "All",
        "description": "Event Hub clients should not use a namespace level access policy that provides access to all queues and topics in a namespace. To align with the least previlege security model, you should create access policies at the entity level for queues and topics to provide access to only the specific entity",
        "metadata": {
            "category": "Event Hub"
        },
        "policyRule": {
            "if": {
              "allOf": [
                {
                  "field": "name",
                  "notEquals": "RootManageSharedAccessKey"
                },
                {
                  "field": "type",
                  "equals": "Microsoft.EventHub/namespaces/authorizationRules"
                }
              ]
            },
            "then": {
              "effect": "Audit"
            }
        }
    }
}
