How to get the report of which Azure VM was rebooted in the past 24 hours?

EnterpriseArchitect 4,466 Reputation points

I have over 1000 VMs running Windows and non-Windows OS in Azure. I need to generate a report of Azure VMs rebooted within the past 24 hours. Is there any way to create such a report with PowerShell or KQL (Kusto Query)? I would like to express my gratitude in advance for your assistance in this matter. Thank you for your anticipated cooperation.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
6,807 questions
Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
9,950 questions
Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,314 questions
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
1,854 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
18,641 questions
{count} votes

Accepted answer
  1. Sabyasachi Samaddar 160 Reputation points Microsoft Employee

    @EnterpriseArchitect Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

    Please find the code you can try to find the last-reboot information through a PowerShell script:

    az login
    az account set --subscription "your_subscription_key"
    $vms= az vm list --query "[].id" -o tsv
    $vms = $vms -split "`n"
    foreach ($vm in $vms) {
    $endTime = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ" 
    $startTime = (Get-Date).AddHours(-24).ToString("yyyy-MM-ddTHH:mm:ssZ")
    # Get the last reboot time
    $lastReboot = az monitor activity-log list --resource-id $vm --start-time $startTime --end-time $endTime --query "[?operationName.value=='Microsoft.Compute/virtualMachines/restart/action'].eventTimestamp" -o tsv
    # Check if the VM has been rebooted in the last 24 hours
    if ($lastReboot) {
        Write-Output "$vm rebooted at $lastReboot"
    #Now in this code, we are using az monitor activity-log list #to find the reboot details of the VM. #This is a basic example. You can now play with the script to display this information in a more user-#friendly way.
    #If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have #extra questions about this answer, please click "Comment". 

0 additional answers

Sort by: Most helpful