Share via

Updatemanagement patch update KQL query

Azure-learning 56 Reputation points
2022-09-20T18:01:20.36+00:00

I am using below query to get installed patches query from updatemanagement run -

UpdateRunProgress | where TimeGenerated>ago(7d) and InstallationStatus == "Succeeded" and UpdateRunName !has "windows_schedule_,manual"
| summarize hint.strategy=partitioned arg_max(TimeGenerated ,Title ) by Computer, SubscriptionId, VMUUID,Title, UpdateRunName, TenantId
| summarize LastUpdateDate=max(TimeGenerated), InstalledUpdateCount = count() by Computer, SubscriptionId, VMUUID,UpdateRunName
| project Computer= Computer, SubscriptionId = SubscriptionId , VMUUID= VMUUID
,installedUpdatesCount=coalesce(InstalledUpdateCount, -1)

but it's not giving tenenatId . Please let me know how to print Tenant id also using any join

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,410 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Maxim Sergeev 6,571 Reputation points Microsoft Employee
    2022-09-20T19:57:38.057+00:00

    Hi there,

    What's the reason to use the tenantId?
    Log Analytics property "tenantId" does not equal tenant of Azure AD.

    The TenantId column holds the workspace ID for the Log Analytics workspace.

    https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns

    If you want to use the Log Analytics workspace tenantId (I have no idea why), you can join the data from other tables like Perf\UpdateSummary etc

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.