How about this example, using arg and logs?
arg('').resources
| where type == "microsoft.compute/virtualmachines"
| extend
machineStatus = properties.extended.instanceView.powerState.displayStatus,
OSType = properties.storageProfile.osDisk.osType
| project
name,
VM=id,
location,
ResourceGroup=resourceGroup,
machineStatus,
OSType,
properties
| join
(
AzureActivity
| where OperationName == "Deallocate Virtual Machine" and ActivityStatus == "Succeeded"
| summarize max(TimeGenerated) by Resource, OperationName
| extend lastSeen = datetime_diff('day', now(), max_TimeGenerated)
)
on $left.name == $right.Resource
| where lastSeen > 45