Custom Alerts for Azure Virtual Desktop

Question

Please help me with kusto queries for setting up custom alerts for Azure Virtual Desktop.   Custom Alerts: |- User Connection Time

• Unexpected Disconnection
• VM's Being Available or Unavailable

• Number of Users Connected to VDI

Answer 1

Hello Syed Aman Welcome to Microsoft Q&A Platform, thanks for posting your query here. To set up custom alerts for Azure Virtual Desktop, you can use Kusto queries in Azure Monitor. Here are some sample queries that you can use for the custom alerts you mentioned:

1. User Connection Time:

AzureActivity
| where OperationNameValue == "Microsoft.DesktopVirtualization/hostPools/sessionHosts/users/start"
| extend User = tostring(parse_json(tostring(Properties)).userPrincipalName)
| extend SessionId = tostring(parse_json(tostring(Properties)).sessionId)
| extend StartTime = todatetime(EventTimestamp)
| project User, SessionId, StartTime

1. Unexpected Disconnection:

AzureActivity
| where OperationNameValue == "Microsoft.DesktopVirtualization/hostPools/sessionHosts/users/disconnect"
| extend User = tostring(parse_json(tostring(Properties)).userPrincipalName)
| extend SessionId = tostring(parse_json(tostring(Properties)).sessionId)
| extend DisconnectTime = todatetime(EventTimestamp)
| project User, SessionId, DisconnectTime

1. VM's Being Available or Unavailable:

Heartbeat
| where TimeGenerated > ago(5m)
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| join kind=leftouter (
    Heartbeat
    | where TimeGenerated > ago(5m)
    | summarize SecondLastHeartbeat = max(TimeGenerated) by Computer
) on Computer
| extend IsAvailable = iif(LastHeartbeat > SecondLastHeartbeat, true, false)
| project Computer, IsAvailable

1. Number of Users Connected to VDI:

AzureActivity
| where OperationNameValue == "Microsoft.DesktopVirtualization/hostPools/sessionHosts/users/start"
| summarize count() by bin(EventTimestamp, 1h)

You can modify these queries as per your requirements and use them to create custom alerts in Azure Monitor.