Need Query or Other option to see how many VM's does not have AzureMonitorWindowsAgent extension installed ?

Question

I Need help to get list of VM which does not have AzureMonitorWindowsAgent extension installed ?

Is there any Kusto or resource graph query or any other way we can confirm ?

Answer 1

Hello,

Welcome to Microsoft Q&A,

You could use the below PowerShell command to see the VMs that do not have this extension enabled.

$vms = Get-AzVM
foreach ($vm in $vms) {
    $extensions = Get-AzVMExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -ErrorAction SilentlyContinue
    if ($extensions.Name -notcontains "AzureMonitorWindowsAgent") {
        Write-Output "$($vm.Name) in $($vm.ResourceGroupName) does NOT have AzureMonitorWindowsAgent"
    }
}

Please Upvote and accept the answer if it helps!!

Answer 2

Hi Shailesh Chauhan,

Open Resource Graph Explorer in Azure and run a below query to know about the VM extension and its Provisioning State.

resources
| where type == "microsoft.compute/virtualmachines/extensions"
| extend VMName = split(id, "/")[8] 
| where name has "<name of the extension>"
| extend SubscriptionName = case(
    subscriptionId == '<your subscription id>', 
    '<your subscription name>', 
    subscriptionId
)
| project VMName, AgentName=name, SubscriptionName, ProvisioningState=properties.provisioningState

The above query will return the extension along with its provisioning state.

I tried below query in my lab environment to check the status of different extensions and its Provisioning State:

If the information is helpful, please click on "Accept Answer" and "Upvote"

If you have any queries, please do let us know, we will help you.

Answer 3

Hi Shailesh Chauhan,

To identify all virtual machines in your environment that do not have the Azure Monitor Windows Agent (AzureMonitorWindowsAgent) extension installed, you can run the following Kusto Query Language (KQL) query in Azure Resource Graph Explorer:

Resources
| where type == "microsoft.compute/virtualmachines"
| extend extensions = properties.extensions
| mv-expand extensions
| extend extensionName = tostring(extensions.name)
| summarize hasAgent = any(extensionName == "AzureMonitorWindowsAgent") by name, resourceGroup, location
| where hasAgent == false

If you found information helpful, please click "Upvote" and "Accept answer" on the post to let us know.

If the issue still persist feel free to ask we are happy to assist you.

Thank You.