Which field is the Recommendation Rule coming from on the Rightsizing Advisor page

Question

Which field is the Recommendation Rule coming from on the Rightsizing Advisor page

51621659 1

Please provide the Advisor table and related field name in Resource Graph Explorer for the Recommendation rule that is displayed on the Advisor Right-size or shutdown underutilized virtual machines page.

Right Size Recommendation Rule field.png

Thank you,

51621659 1 Reputation point

2025-12-26T22:49:42.7033333+00:00

Hi Bharath,

I was happy to see your name. I will try this. I also need to get the Subscription Name for the Advisor Recommendations and I am not having any luck.

Thank you for your assistance.

Bharath Y P 3,620 Microsoft External Staff Moderator

Hello 51621659, I’m glad to hear that! The reason you don’t see the subscription name is because Advisor recommendations only store the subscriptionId in their record, while the actual name is kept in a separate table

Below query will pull Advisor recommendations for underutilized VMs and add the subscription name:

advisorresources
| where type == "microsoft.advisor/recommendations"
| where properties.category == "Cost"
| where tostring(properties.impactedField) == "Microsoft.Compute/virtualMachines"
| where properties.shortDescription.problem has "underutilized"
| project
    id,
    name,
    problem = properties.shortDescription.problem,
    solution = properties.shortDescription.solution,
    resourceId = properties.resourceMetadata.resourceId,
    avgCpu = properties.extendedProperties.avgCpuPercentage,
    cpuThreshold = properties.extendedProperties.cpuThreshold,
    extendedProperties = properties.extendedProperties,
    subscriptionId
| join kind=leftouter (
    resourcecontainers
    | where type == "microsoft.resources/subscriptions"
    | project subscriptionId, subscriptionName = name, displayName
) on subscriptionId

Hope this helps! thanks

Suchitra Suregaunkar 6,060 Reputation points Microsoft External Staff Moderator

2025-12-29T07:04:36.6433333+00:00

Hello 51621659

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.
51621659 1 Reputation point

2025-12-29T17:03:00.27+00:00

Hello Bharath,

For some reason we have null for the avgCpuPercentage and cpuThreshold when I run the above query.
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-29T22:10:51.82+00:00
Hello 51621659, Thanks for update, you’re seeing null for avgCpuPercentage and cpuThreshold in the Azure Advisor recommendations dataset. This occurs even though the recommendation correctly identifies the VM as underutilized or The extendedProperties field in Advisor recommendations is stored as a dynamic object. Accessing nested values directly without casting often results in null, even when the data exists.

Also this can happen if the virtual machine was stopped or mostly idle during the evaluation period, if there wasn’t enough CPU usage data available, or if Azure Advisor created the recommendation based on estimates instead of actual performance metrics.

Inspect the extendedProperties: Add a projection to list all keys inside ext so you can see what’s actually available:

advisorresources | where type == "microsoft.advisor/recommendations" | where properties.category == "Cost" | where tostring(properties.impactedField) == "Microsoft.Compute/virtualMachines" | where properties.shortDescription.problem has "underutilized" | extend ext = try_cast(properties.extendedProperties, dynamic) | project name, keys = bag_keys(ext), ext

This shows you which fields exist for each recommendation.
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-31T00:44:46.49+00:00

Hello 51621659, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. Thanks
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-31T23:51:19.27+00:00

Hello 51621659, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. Thanks

1 answer

Your answer

51621659 1 Reputation point

2025-12-26T22:49:42.7033333+00:00

Hi Bharath,

I was happy to see your name. I will try this. I also need to get the Subscription Name for the Advisor Recommendations and I am not having any luck.

Thank you for your assistance.
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-26T23:18:47.5633333+00:00

Hello 51621659, I’m glad to hear that! The reason you don’t see the subscription name is because Advisor recommendations only store the subscriptionId in their record, while the actual name is kept in a separate table

Below query will pull Advisor recommendations for underutilized VMs and add the subscription name:

advisorresources | where type == "microsoft.advisor/recommendations" | where properties.category == "Cost" | where tostring(properties.impactedField) == "Microsoft.Compute/virtualMachines" | where properties.shortDescription.problem has "underutilized" | project id, name, problem = properties.shortDescription.problem, solution = properties.shortDescription.solution, resourceId = properties.resourceMetadata.resourceId, avgCpu = properties.extendedProperties.avgCpuPercentage, cpuThreshold = properties.extendedProperties.cpuThreshold, extendedProperties = properties.extendedProperties, subscriptionId | join kind=leftouter ( resourcecontainers | where type == "microsoft.resources/subscriptions" | project subscriptionId, subscriptionName = name, displayName ) on subscriptionId

Hope this helps! thanks
Suchitra Suregaunkar 6,060 Reputation points Microsoft External Staff Moderator

2025-12-29T07:04:36.6433333+00:00

Hello 51621659

Please let us know if the suggested resolution helped/ addressed your concern. If it did, we’d appreciate your feedback on the proposed resolution as it helps others with similar issues.

If the resolution did not help, feel free to share more details about the challenge you’re still facing. Any additional information such as your current issue or specific errors will help us perform a deeper analysis and provide more targeted guidance.

We’re happy to continue assisting and work with you toward the right solution.

Thanks,

Suchitra.
51621659 1 Reputation point

2025-12-29T17:03:00.27+00:00

Hello Bharath,

For some reason we have null for the avgCpuPercentage and cpuThreshold when I run the above query.
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-29T22:10:51.82+00:00

Hello 51621659, Thanks for update, you’re seeing null for avgCpuPercentage and cpuThreshold in the Azure Advisor recommendations dataset. This occurs even though the recommendation correctly identifies the VM as underutilized or The extendedProperties field in Advisor recommendations is stored as a dynamic object. Accessing nested values directly without casting often results in null, even when the data exists.

Also this can happen if the virtual machine was stopped or mostly idle during the evaluation period, if there wasn’t enough CPU usage data available, or if Azure Advisor created the recommendation based on estimates instead of actual performance metrics.

Inspect the extendedProperties: Add a projection to list all keys inside ext so you can see what’s actually available:

advisorresources | where type == "microsoft.advisor/recommendations" | where properties.category == "Cost" | where tostring(properties.impactedField) == "Microsoft.Compute/virtualMachines" | where properties.shortDescription.problem has "underutilized" | extend ext = try_cast(properties.extendedProperties, dynamic) | project name, keys = bag_keys(ext), ext

This shows you which fields exist for each recommendation.
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-31T00:44:46.49+00:00

Hello 51621659, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. Thanks
Bharath Y P 3,620 Reputation points Microsoft External Staff Moderator

2025-12-31T23:51:19.27+00:00

Hello 51621659, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. Thanks

Answer 1

Hello 51621659, You looking for the Azure Advisor recommendation rule for Right-size or shutdown underutilized virtual machines (specifically when CPU utilization < 20%) and how this is represented in Azure Resource Graph Explorer. You want to know the table name and the related field names that capture this recommendation.

The Azure Advisor recommendation for CPU Utilization < 20% is stored in the advisorresources table in Azure Resource Graph. The CPU threshold and average utilization values are not first‑class columns; instead, they are embedded within properties.extendedProperties of the recommendation record.You can filter for Cost recommendations related to underutilized VMs

advisorresources
| where type == "microsoft.advisor/recommendations"
| where properties.category == "Cost"
| where properties.shortDescription.problem has "underutilized"

Locate the CPU rule inside extendedProperties for example Average CPU usage in properties.extendedProperties.avgCpuPercentage

The query you can try like below:

advisorresources
| where type == "microsoft.advisor/recommendations"
| where properties.category == "Cost"
| where tostring(properties.impactedField) == "Microsoft.Compute/virtualMachines"
| where properties.shortDescription.problem has "underutilized"
| project
    id,
    name,
    problem = properties.shortDescription.problem,
    solution = properties.shortDescription.solution,
    resourceId = properties.resourceMetadata.resourceId,
    avgCpu = properties.extendedProperties.avgCpuPercentage,
    cpuThreshold = properties.extendedProperties.cpuThreshold,    
    extendedProperties = properties.extendedProperties

Reduce service costs using Azure Advisor - Azure Advisor | Microsoft Learn

Hope this helps, please do let us know if you have any questions, Thanks

Share via

Which field is the Recommendation Rule coming from on the Rightsizing Advisor page

1 answer

Your answer