KQL- in/has-any usage

o check if AppID (a comma-separated list) matches any value in AppIDList using Kusto Query Language (KQL), you should use the has_any operator instead of in. The in operator works when comparing a single value against a set, but for lists of values (like tags), has_any checks for intersections between arrays or strings.

Here's how you can modify your query:

let AppIDList = dynamic(["APPID01", "APPID02", "APPID03"]);

resources
| where type !in~ ("microsoft.compute/snapshots", "microsoft.compute/virtualmachines/extensions")
| project subscriptionId, type, resourceGroup, name, AppID = tostring(['tags']['AppID'])
| where AppID has_any (AppIDList)    // Use has_any for matching against a list of AppIDs
| join kind=inner (
    resourcecontainers
    | where ['type'] == "microsoft.resources/subscriptions"
    | project subscriptionId, name, subname = name
) on $left.subscriptionId == $right.subscriptionId
| project subname, subscriptionId, type, resourceGroup, name