Retrieves Azure Arc-enabled machines with their agent version, OS version, status, cloud provider, and last status change timestamp (in UTC). Helps identify machines with outdated Arc agents or stale status updates.

AzureArcVersions.kql

resources
| where type == "microsoft.hybridcompute/machines"
| extend 
    ArcAgentVersion = tostring(properties.agentVersion),
    OSVersion = tostring(properties.osSku),
    MachineName = tostring(properties.machineFqdn),
    Status = tostring(properties.status),
    LastStatusChangeRaw = todatetime(properties.lastStatusChange),
    LastStatusChangeUTC = format_datetime(todatetime(properties.lastStatusChange), 'yyyy-MM-dd HH:mm:ss'),
    Provider = tostring(properties['cloudMetadata']['provider'])
| project MachineName, ArcAgentVersion, OSVersion, Status, Provider, LastStatusChangeUTC
| order by ArcAgentVersion desc