How to get server list associated with DCR. also,Servers in Azure data collection rule are decreasing. couldn't find in activity log any activity during that time period.

Question

How to get server list associated with DCR. there is no option available in portal to get the list of servers associated with Data collection rule. also, Servers in Azure data collection rule are decreasing. couldn't find in activity log any activity during that time period that disassociating the VMs from DCR.

Answer 1

Hello Aditi Sharma, It looks like you are trying to retrieve the list of servers (VMs / Arc machines) associated with a Data Collection Rule (DCR) in Microsoft Azure. But the Azure portal does not provide a direct view, number of associated servers is decreasing and there are no visible disassociation events in Activity Logs.

 DCR associations are stored as Data Collection Rule Associations (DCRAs). The portal doesn’t show a consolidated list of servers tied to a DCR.  You need to use CLI, PowerShell, or Resource Graph to query associations.

To get the list associated servers for the DCR, use the Azure Resource Graph Explorer for the "Source of Truth."

• Search for Resource Graph Explorer in the Azure Portal.
• Run the following query to see every server currently linked to a DCR:

resources
| where type =~ 'microsoft.insights/datacollectionruleassociations'
| extend dcrId = tostring(properties.dataCollectionRuleId)
| extend targetResourceId = tostring(properties.resourceId)
| project targetResourceId, dcrId, AssociationName = name, location
| join kind=leftouter (
    resources | project VMName = name, id
) on $left.targetResourceId == $right.id
| project VMName, targetResourceId, dcrId

DCR associations are control‑plane objects. Some association lifecycle events are handled by Azure Monitor Configuration Service. These changes do not always emit Activity Log entries.

Manage data collection rule associations in Azure Monitor - Azure Monitor | Microsoft Learn

But you can try to look for the Association deletion, not the VM deletion:

1. Go to Monitor > Activity Log.
2. Set the Timespan to the last 24 - 48 hours.
3. Add a filter: Resource Type = Microsoft.Insights/dataCollectionRuleAssociations.
4. Look for the operation "Delete Data Collection Rule Association".
5. Check the "Event initiated by" column. It will likely show a Service Principal (Automation) or a specific User Email.

For example:

resourcechanges
| where resourceType == "microsoft.insights/datacollectionruleassociations"
| where changeType == "Delete"
| project timestamp, targetResourceId, changedBy

Hope that helps you list out all servers! please feel free to reach out if you have any further questions. Thanks

Answer 2

To list servers (VMs) associated with a Data Collection Rule (DCR) and investigate why the count is decreasing, use the following options.

1. Use the Azure portal DCR views

• In the Azure portal, go to Monitor → Data Collection Rules.
• Select the specific DCR.
• Open the Resources tab to see all resources (including VMs) associated with that DCR and add/remove associations if needed.

If the preview experience is enabled:

• In Monitor → Data Collection Rules, switch to the Data collection rule view.
• The Resource count column shows how many resources are associated with each DCR; select the number to open the Resources view for that DCR and see the list of associated resources.
• In the Resources view, the Data collection rules column shows how many DCRs each resource is associated with; select the number on a VM row to see which DCRs are attached to that VM.

2. Use Azure Resource Graph to list VMs and their DCRs

Run the provided Azure Resource Graph query (via Azure portal → Resource Graph Explorer) to list all VMs that have DCR associations and which DCRs they are associated with:

• The sample query under Azure Monitor → List VMs with data collection rule associations returns, for each VM, a list of associated DCR IDs and a count (dcrCount). This lets you see where associations may have been removed over time.

3. Use PowerShell to list DCRs for a specific VM

For a given VM, run:

Get-AzDataCollectionRuleAssociation -resourceUri <vm-resource-id>

This returns all DCR associations for that VM. Comparing outputs over time (for example via automation or scheduled scripts) can help detect when associations are removed.

4. Investigate why servers are disappearing from the DCR

• Use the Resources tab on the DCR and the Resources view in the preview experience to confirm which VMs are currently associated.
• Use the Resource Graph query to verify whether DCR associations exist at the platform level.
• If VMs are being re-created (for example, via scale sets or automation), new instances may not inherit the original DCR association unless explicitly configured.
• Be aware of duplicate or overlapping DCRs: a VM can be associated with multiple DCRs, and changes to those associations can affect which DCR appears to be “losing” servers.

Note: Activity logs may not always show DCR association changes in a way that is easy to correlate by time; using Resource Graph and Get-AzDataCollectionRuleAssociation provides a more direct view of current associations.

---

References:

• Manage data collection rule associations in Azure Monitor
• Viewing data collection rules (DCRs) in Azure Monitor
• Monitor virtual machines with Azure Monitor: Collect data
• Collect data from virtual machine client with Azure Monitor
• Azure Resource Graph sample queries by category