How to Find Azure Resources with Public IP Addresses

Copper Contributor

Aug 28, 2024

Below is a resource graph KQL query to list all Public IPs with attached resource details for each. Also VM Details attached details If attached resource type is NIC.

It’s not neat as it should be, but at least it get the details:

Resources
| join kind=inner  
    (resourcecontainers 
    | where type == 'microsoft.resources/subscriptions' 
    | project SubscriptionName=name, subscriptionId
    )
    on subscriptionId 
| where type == 'microsoft.network/publicipaddresses'
| where SubscriptionName startswith "ag-azr-"
| project
    PIP_LOC = location,
    PIP_SUB = SubscriptionName,
    PIP_RG = resourceGroup, 
    PIP_Name = name,
    PIP_skuName = sku.name,
    PIP_skuTier = sku.tier,
    PIP_zones = zones,
    PIP_ddos = properties.ddosSettings.protectionMode,
    publicIPAllocationMethod = properties.publicIPAllocationMethod,
    publicIPAddressVersion = properties.publicIPAddressVersion,
    ipAddress = properties.ipAddress,
    Attched_resourceID = tolower(split(properties.ipConfiguration.id, '/ipConfigurations')[0]), 
    Attched_resourceName = split(properties.ipConfiguration.id, '/')[8],
    Attched_resourceRG = split(properties.ipConfiguration.id, '/')[4],
    Attched_resourceType = strcat(split(properties.ipConfiguration.id, '/')[6], "/", split(properties.ipConfiguration.id, '/')[7])
| join kind=leftouter  
    (resources
    | where type == "microsoft.network/networkinterfaces"
    | project Attched_resourceID = tolower(id),
      VMID = properties.virtualMachine.id
    )
    on Attched_resourceID 
| project-away Attched_resourceID1
| extend VM_RG = split(VMID, '/')[4]
| extend VM_Name = split(VMID, '/')[8]

Blog Post

How to Find Azure Resources with Public IP Addresses