Count number of VMs & VMSS by OS type with Resource Graph Explorer

As part of SOC work you may want to check in your Azure environment the number of VMs or VM Scalesets  by Operating System type so you can report to InfoSec leader. Moreover that helps plan security patching better.

This article is just to share with you a simple Resource Graph Explorer to get the job done.

If you don’t know Azure Resource Graph, I’d highly recommend you to read this article

// Sample query to get the number of VMs and VMSS by OS Type
| where type == "microsoft.compute/virtualmachines"
| extend osType = tostring(properties.storageProfile.osDisk.osType)
| summarize countOs = count() by osType
// Use Union to merge with VMSs Query result
| union (
  | where type == "microsoft.compute/virtualmachinescalesets"
  | extend 
    instance_count  = toint(sku.capacity),
    osProfile = properties.virtualMachineProfile.osProfile
  | extend osType = case (tostring(osProfile.linuxConfiguration) != "", "Linux",
                          tostring(osProfile.windowsConfiguration) != "", "Windows",
                          "Unknown" )
  | summarize countOs = sum(instance_count) by osType
| summarize vmCount = sum(countOs) by osType

Run the query and check the result. The sample result below shows you that the total number of VMs and VM Scalesets running Windows OS is 60 and Linux is 145.

You can use the query in your workbook and add the subscription filter to get the number on selected subscription.

| where "{Subscription:value}" == "All" or 
        "{Subscription:value}" == "All" or 
        "{Subscription:label}" == "All" or 
        subscriptionId in ({Subscription:subid})



This entry was posted in Governance & Compliance, Security Operation and tagged , . Bookmark the permalink.

Leave a Reply

Your email address will not be published.