Edit

Share via

Azure Resource Graph sample queries for Azure Arc-enabled servers

Azure Resource Graph is an Azure service that lets you query at scale, helping you effectively govern your environment. Queries are created using Kusto Query Language (KQL). For more information, see Understanding the Azure Resource Graph query language.

This page provides a list of sample Azure Resource Graph queries for Azure Arc-enabled servers. You can run these queries through Azure PowerShell or Azure CLI, or in the Azure portal using the Resource Graph Explorer. Feel free to modify the queries to suit your needs.

Tip

You can use Microsoft Copilot in Azure to author Azure Resource Graph queries using natural language. For more information, see Get resource information using Microsoft Copilot in Azure.

Sample queries

Get count and percentage of Arc-enabled servers by domain

This query summarizes the domainName property on Azure Arc-enabled servers and uses a calculation with bin to create a Pct column for the percent of Arc-enabled servers per domain.

Resources
| where type == 'microsoft.hybridcompute/machines'
| project domain=tostring(properties.domainName)
| summarize Domains=make_list(domain), TotalMachineCount=sum(1)
| mvexpand EachDomain = Domains
| summarize PerDomainMachineCount = count() by tostring(EachDomain), TotalMachineCount
| extend Pct = 100 * bin(todouble(PerDomainMachineCount) / todouble(TotalMachineCount), 0.001)

az graph query -q "Resources | where type == 'microsoft.hybridcompute/machines' | project domain=tostring(properties.domainName) | summarize Domains=make_list(domain), TotalMachineCount=sum(1) | mvexpand EachDomain = Domains | summarize PerDomainMachineCount = count() by tostring(EachDomain), TotalMachineCount | extend Pct = 100 * bin(todouble(PerDomainMachineCount) / todouble(TotalMachineCount), 0.001)"

List all extensions installed on an Azure Arc-enabled server

First, this query uses project on the hybrid machine resource type to get the ID in uppercase (toupper()), get the computer name, and the operating system running on the machine. Getting the resource ID in uppercase is a good way to prepare to join to another property. Then, the query uses join with kind as leftouter to get extensions by matching an uppercase substring of the extension ID. The portion of the ID before /extensions/<ExtensionName> is the same format as the hybrid machine ID, so we use this property for the join. summarize is then used with make_list on the name of the virtual machine extension to combine the name of each extension where ID, OSName, and ComputerName are the same into a single array property. Lastly, we order by lowercase OSName with asc. By default, order by is descending.

Resources
| where type == 'microsoft.hybridcompute/machines'
| project
  id,
  JoinID = toupper(id),
  ComputerName = tostring(properties.osProfile.computerName),
  OSName = tostring(properties.osName)
| join kind=leftouter(
  Resources
  | where type == 'microsoft.hybridcompute/machines/extensions'
  | project
    MachineId = toupper(substring(id, 0, indexof(id, '/extensions'))),
    ExtensionName = name
) on $left.JoinID == $right.MachineId
| summarize Extensions = make_list(ExtensionName) by id, ComputerName, OSName
| order by tolower(OSName) asc

az graph query -q "Resources | where type == 'microsoft.hybridcompute/machines' | project id, JoinID = toupper(id), ComputerName = tostring(properties.osProfile.computerName), OSName = tostring(properties.osName) | join kind=leftouter( Resources | where type == 'microsoft.hybridcompute/machines/extensions' | project  MachineId = toupper(substring(id, 0, indexof(id, '/extensions'))),  ExtensionName = name ) on \$left.JoinID == \$right.MachineId | summarize Extensions = make_list(ExtensionName) by id, ComputerName, OSName | order by tolower(OSName) asc"

List Arc-enabled servers not running latest released agent version

This query returns all Arc-enabled servers running an outdated version of the Connected Machine agent. Agents with a status of Expired are excluded from the results. The query uses leftouter join to bring together the Advisor recommendations raised about any Connected Machine agents identified as out of date, and Hybrid Computer machines to filter out any agent that hasn't communicated with Azure over a period of time.

AdvisorResources
| where type == 'microsoft.advisor/recommendations'
| where properties.category == 'HighAvailability'
| where properties.shortDescription.solution == 'Upgrade to the latest version of the Azure Connected Machine agent'
| project
    id,
    JoinId = toupper(properties.resourceMetadata.resourceId),
    machineName = tostring(properties.impactedValue),
    agentVersion = tostring(properties.extendedProperties.installedVersion),
    expectedVersion = tostring(properties.extendedProperties.latestVersion)
| join kind=leftouter(
  Resources
  | where type == 'microsoft.hybridcompute/machines'
  | project
    machineId = toupper(id),
    status = tostring (properties.status)
  ) on $left.JoinId == $right.machineId
| where status != 'Expired'
| summarize by id, machineName, agentVersion, expectedVersion
| order by tolower(machineName) asc

az graph query -q "AdvisorResources | where type == 'microsoft.advisor/recommendations' | where properties.category == 'HighAvailability' | where properties.shortDescription.solution == 'Upgrade to the latest version of the Azure Connected Machine agent' | project  id,  JoinId = toupper(properties.resourceMetadata.resourceId),  machineName = tostring(properties.impactedValue),  agentVersion = tostring(properties.extendedProperties.installedVersion),  expectedVersion = tostring(properties.extendedProperties.latestVersion) | join kind=leftouter( Resources | where type == 'microsoft.hybridcompute/machines' | project  machineId = toupper(id),  status = tostring (properties.status) ) on \$left.JoinId == \$right.machineId | where status != 'Expired' | summarize by id, machineName, agentVersion, expectedVersion | order by tolower(machineName) asc"

List Arc-enabled servers with SQL Server, PostgreSQL, or MySQL installed

This query returns all Arc-enabled servers that have SQL Server, PostgreSQL, or MySQL installed.

resources
| where type =~ 'microsoft.hybridcompute/machines'
| extend machineId = tolower(tostring(id)), datacenter = iif(isnull(tags.Datacenter), '', tags.Datacenter), status = tostring(properties.status)
| extend mssqlinstalled = coalesce(tobool(properties.detectedProperties.mssqldiscovered),false)
| extend pgsqlinstalled = coalesce(tobool(properties.detectedProperties.pgsqldiscovered),false)
| extend mysqlinstalled = coalesce(tobool(properties.detectedProperties.mysqldiscovered),false)
| extend osSku = properties.osSku, osName = properties.osName, osVersion = properties.osVersion
| extend coreCount = tostring(properties.detectedProperties.logicalCoreCount), totalPhysicalMemoryinGB = tostring(properties.detectedProperties.totalPhysicalMemoryInGigabytes) 
| extend operatingSystem = iif(isnotnull(osSku), osSku, osName)
| where mssqlinstalled or mysqlinstalled or pgsqlinstalled
| project id ,name, type, resourceGroup, subscriptionId, location, kind, osVersion, status, osSku,coreCount,totalPhysicalMemoryinGB,tags, mssqlinstalled, mysqlinstalled, pgsqlinstalled
| sort by (tolower(tostring(name))) asc

az graph query -q "resources | where type =~ 'microsoft.hybridcompute/machines' | extend machineId = tolower(tostring(id)), datacenter = iif(isnull(tags.Datacenter), '', tags.Datacenter), status = tostring(properties.status) | extend mssqlinstalled = coalesce(tobool(properties.detectedProperties.mssqldiscovered),false) | extend pgsqlinstalled = coalesce(tobool(properties.detectedProperties.pgsqldiscovered),false) | extend mysqlinstalled = coalesce(tobool(properties.detectedProperties.mysqldiscovered),false) | extend osSku = properties.osSku, osName = properties.osName, osVersion = properties.osVersion | extend coreCount = tostring(properties.detectedProperties.logicalCoreCount), totalPhysicalMemoryinGB = tostring(properties.detectedProperties.totalPhysicalMemoryInGigabytes)  | extend operatingSystem = iif(isnotnull(osSku), osSku, osName) | where mssqlinstalled or mysqlinstalled or pgsqlinstalled | project id ,name, type, resourceGroup, subscriptionId, location, kind, osVersion, status, osSku,coreCount,totalPhysicalMemoryinGB,tags, mssqlinstalled, mysqlinstalled, pgsqlinstalled | sort by (tolower(tostring(name))) asc"

Next steps