Skip to main content

Virtual machines

Get list of Windows VM on which Microsoft Antivirus (Defender) is not installed:​

securityresources
| where type == "microsoft.security/assessments"
| where properties.metadata.displayName == "Install endpoint protection solution on virtual machines"
| where properties.status.code == "Unhealthy"

Get list of Virtual Machine on which OS Update are not deployed:​

securityresources
| where type == "microsoft.security/assessments"
| where properties.metadata.displayName == "System updates should be installed on your machines"
| where properties.status.code == "Unhealthy"

Get list of Virtual Machine with Cost Advisor recommendations​

advisorresources
| where type == "microsoft.advisor/recommendations"
| where properties.category == "Cost"
| where properties.impactedField == "Microsoft.Compute/virtualMachines"

Get list of Virtual Machines in Stopped state​

resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| project name, location, properties.provisioningState, properties.timeCreated , PowerStatus = tostring(properties.extended.instanceView.powerState.displayStatus), subscriptionId
| where PowerStatus == 'VM stopped'