Kusto Query to get Report on Orphaned Azure VM Disks and when they became unattached.

Question

I am looking at getting reports on Azure Orphaned Disks. Right now I can pull the reports, but I would like to include the date the disks became unattached or how long the disks have been unattached. I am pulling this for all our subscriptions using Azure Resource Graph Explorer. How can I capture that date component? So far, this is the query I am running:

Resources

| where type has "microsoft.compute/disks"

| extend diskState = tostring(properties.diskState)

| where managedBy == ""

or diskState == 'Unattached' and  diskState != 'ActiveSAS'

| project id, diskState, resourceGroup, location, subscriptionId

Answer 1

Hi, Maurice

Unfortunately, this metadata is not kept on the managed disks; you could have an Azure Activity Log that triggers an email notification if the disk becomes unattached or have a runbook that alerts on any disks that are unattached each week, to help give you a timeframe.

Heres another question that could be helpful to point you in the right direction: https://learn.microsoft.com/en-us/answers/questions/423773/how-to-find-disks-that-are-not-attached-used-more

Answer 2

I went with a third party tool, Cloudhealth (https://cloudhealth.vmware.com/)