Need Query or Other option to see how many VM's does not have AzureMonitorWindowsAgent extension installed ?

Question

Need Query or Other option to see how many VM's does not have AzureMonitorWindowsAgent extension installed ?

Shailesh Chauhan 0

I Need help to get list of VM which does not have AzureMonitorWindowsAgent extension installed ?

Is there any Kusto or resource graph query or any other way we can confirm ?

Pramidha Yathipathi 600 Reputation points Microsoft External Staff

2025-05-05T20:13:08.7166667+00:00
Hi Shailesh Chauhan,

It looks like you're looking for a way to identify which of your Azure VMs don't have the Azure Monitor Windows Agent extension installed. You have a couple of options here, including using Azure Resource Graph or Kusto Query Language (KQL).

Using Azure Resource Graph Query

You can run the following Resource Graph query to get a list of VMs without the Azure Monitor Windows Agent:

Resources | where type == "microsoft.compute/virtualmachines" | where properties.extensions[?].type != "Microsoft.Azure.Monitor.WindowsAgent" | project name, resourceGroup, location

Using Kusto Query (if using Azure Log Analytics)

If you’re using Log Analytics, you can use this Kusto query:

Heartbeat | where TimeGenerated >= ago(30d) | summarize Count = count() by Computer | join kind=leftanti ( Extensions | where Type == "Microsoft.Azure.Monitor.WindowsAgent" | project Computer = tostring( properties.vmId) ) on Computer | project Computer

If you found information helpful, please click "Upvote" on the post to let us know.

If the issue still persist feel free to ask we are happy to assist you.

Thank You.
Shailesh Chauhan 0 Reputation points

2025-05-06T12:43:31.7166667+00:00

None of the above query are working.
Divyesh Govaerdhanan 3,730 Reputation points

2025-05-06T12:47:19.3866667+00:00

@Shailesh Chauhan Did you try using the PowerShell script that I shared below?
Pramidha Yathipathi 600 Reputation points Microsoft External Staff

2025-05-06T13:39:47.4366667+00:00
Hi Shailesh Chauhan,

To identify all virtual machines in your environment that do not have the Azure Monitor Windows Agent (AzureMonitorWindowsAgent) extension installed, you can run the following Kusto Query Language (KQL) query in Azure Resource Graph Explorer:

Resources | where type == "microsoft.compute/virtualmachines" | extend extensions = properties.extensions | mv-expand extensions | extend extensionName = tostring(extensions.name) | summarize hasAgent = any(extensionName == "AzureMonitorWindowsAgent") by name, resourceGroup, location | where hasAgent == false

If you found information helpful, please click "Upvote" on the post to let us know.

If the issue still persist feel free to ask we are happy to assist you.

Thank You.
Pramidha Yathipathi 600 Reputation points Microsoft External Staff

2025-05-07T17:06:04.7666667+00:00

Hi Shailesh Chauhan,

Just checking into see if you had a chance to review the latest comment provided; is the issue resolved. Let me know if you have any further queries we are happy to assist you.

If you found information helpful, please click "Upvote" on the post to let us know.

Thank You.

2 answers

Your answer

Pramidha Yathipathi 600 Reputation points Microsoft External Staff

2025-05-05T20:13:08.7166667+00:00

Hi Shailesh Chauhan,

It looks like you're looking for a way to identify which of your Azure VMs don't have the Azure Monitor Windows Agent extension installed. You have a couple of options here, including using Azure Resource Graph or Kusto Query Language (KQL).

Using Azure Resource Graph Query

You can run the following Resource Graph query to get a list of VMs without the Azure Monitor Windows Agent:

Resources | where type == "microsoft.compute/virtualmachines" | where properties.extensions[?].type != "Microsoft.Azure.Monitor.WindowsAgent" | project name, resourceGroup, location

Using Kusto Query (if using Azure Log Analytics)

If you’re using Log Analytics, you can use this Kusto query:

Heartbeat | where TimeGenerated >= ago(30d) | summarize Count = count() by Computer | join kind=leftanti ( Extensions | where Type == "Microsoft.Azure.Monitor.WindowsAgent" | project Computer = tostring( properties.vmId) ) on Computer | project Computer

If you found information helpful, please click "Upvote" on the post to let us know.

If the issue still persist feel free to ask we are happy to assist you.

Thank You.
Shailesh Chauhan 0 Reputation points

2025-05-06T12:43:31.7166667+00:00

None of the above query are working.
Divyesh Govaerdhanan 3,730 Reputation points

2025-05-06T12:47:19.3866667+00:00

@Shailesh Chauhan Did you try using the PowerShell script that I shared below?
Pramidha Yathipathi 600 Reputation points Microsoft External Staff

2025-05-06T13:39:47.4366667+00:00

Hi Shailesh Chauhan,

To identify all virtual machines in your environment that do not have the Azure Monitor Windows Agent (AzureMonitorWindowsAgent) extension installed, you can run the following Kusto Query Language (KQL) query in Azure Resource Graph Explorer:

Resources | where type == "microsoft.compute/virtualmachines" | extend extensions = properties.extensions | mv-expand extensions | extend extensionName = tostring(extensions.name) | summarize hasAgent = any(extensionName == "AzureMonitorWindowsAgent") by name, resourceGroup, location | where hasAgent == false

If you found information helpful, please click "Upvote" on the post to let us know.

If the issue still persist feel free to ask we are happy to assist you.

Thank You.
Pramidha Yathipathi 600 Reputation points Microsoft External Staff

2025-05-07T17:06:04.7666667+00:00

Hi Shailesh Chauhan,

Just checking into see if you had a chance to review the latest comment provided; is the issue resolved. Let me know if you have any further queries we are happy to assist you.

If you found information helpful, please click "Upvote" on the post to let us know.

Thank You.

Answer 1

Divyesh Govaerdhanan 3,730

Hello,

Welcome to Microsoft Q&A,

You could use the below PowerShell command to see the VMs that do not have this extension enabled.

$vms = Get-AzVM
foreach ($vm in $vms) {
    $extensions = Get-AzVMExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -ErrorAction SilentlyContinue
    if ($extensions.Name -notcontains "AzureMonitorWindowsAgent") {
        Write-Output "$($vm.Name) in $($vm.ResourceGroupName) does NOT have AzureMonitorWindowsAgent"
    }
}

Please Upvote and accept the answer if it helps!!

Shailesh Chauhan 0 Reputation points

2025-05-06T13:43:43.09+00:00

Will Try this script later today.

Answer 2

Hi Shailesh Chauhan,

Open Resource Graph Explorer in Azure and run a below query to know about the VM extension and its Provisioning State.

resources
| where type == "microsoft.compute/virtualmachines/extensions"
| extend VMName = split(id, "/")[8] 
| where name has "<name of the extension>"
| extend SubscriptionName = case(
    subscriptionId == '<your subscription id>', 
    '<your subscription name>', 
    subscriptionId
)
| project VMName, AgentName=name, SubscriptionName, ProvisioningState=properties.provisioningState

The above query will return the extension along with its provisioning state.

I tried below query in my lab environment to check the status of different extensions and its Provisioning State: User's image

User's image

If the information is helpful, please click on "Accept Answer" and "Upvote"

If you have any queries, please do let us know, we will help you.

Shailesh Chauhan 0 Reputation points

2025-05-06T13:13:19.8166667+00:00

Thanks for this but this is also not fullfill my requirement.

I Need help to get list of VM which does not have AzureMonitorWindowsAgent extension installed ?

Is there any Kusto or resource graph query or any other way we can confirm ?

Share via

Need Query or Other option to see how many VM's does not have AzureMonitorWindowsAgent extension installed ?

2 answers

Your answer