Update management report across subscriptions

%3CLINGO-SUB%20id%3D%22lingo-sub-998356%22%20slang%3D%22en-US%22%3EUpdate%20management%20report%20across%20subscriptions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-998356%22%20slang%3D%22en-US%22%3EHi%20Everyone%2C%3CBR%20%2F%3EIf%20say%20I%20have%205%20subscriptions%20under%20the%20same%20tenant%2C%20any%20ideas%20how%20can%20I%20get%20a%20weekly%20report%20for%20the%20updates%20applied%2Fmissing%2Frequired%20across%20the%20subscriptions%3F%20I%E2%80%99m%20looking%20into%20getting%20a%20weekly%20report%2F%20dashboard%20view%20of%20the%20updates.%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-998356%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001353%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20management%20report%20across%20subscriptions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001353%22%20slang%3D%22en-US%22%3EDo%20you%20have%20the%20query%3F%20If%20you%20do%20you%20can%20add%20it%20to%20an%20Azure%20Monitor%20workbook%20for%20a%20visualization.%20You%20can%20create%20a%20scheduled%20Logic%20App%20if%20you%20need%20it%20to%20run%20weekly...happy%20to%20provide%20examples%20of%20both%3F%3CBR%20%2F%3E%3CBR%20%2F%3ELogic%20app%3CBR%20%2F%3E%3CBR%20%2F%3ESchedule%20trigger%20to%20Log%20Analytics%20Query%20to%20Send%20Email%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001797%22%20slang%3D%22en-US%22%3ERe%3A%20Update%20management%20report%20across%20subscriptions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001797%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F453468%22%20target%3D%22_blank%22%3E%40az_cloudadmin%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere's%20an%20example%20below%20on%20how%20to%20construct%20a%20query%20across%20multiple%20workspaces.%26nbsp%3B%20As%20you%20said%20they%20are%20under%20the%20same%20tenant%20then%20copy%20the%20format%20below%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3Eunion%20Update%2C%20workspace(%22contosoretail-it%22).Update%2C%20workspace(%22b459b4u5-912x-46d5-9cb1-p43069212nb4%22).Update%0A%7C%20where%20TimeGenerated%20%26gt%3B%3D%20ago(1h)%0A%7C%20where%20UpdateState%20%3D%3D%20%22Needed%22%0A%7C%20summarize%20dcount(Computer)%20by%20Classification%0A%0A%0A%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Efrom%20the%20ms%20docs%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Fcross-workspace-query%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Fcross-workspace-query%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20the%20report%20part%20as%20the%20previous%20reply%20said%2C%20use%20function%20or%20logic%20app%20to%20trigger%20running%20the%20query%20at%20intervals%2C%20and%20use%20function%2Bsendgrid%20or%20e-mail%20option%20in%20logicapp%20to%20mail%20it%20out.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor
Hi Everyone,
If say I have 5 subscriptions under the same tenant, any ideas how can I get a weekly report for the updates applied/missing/required across the subscriptions? I’m looking into getting a weekly report/ dashboard view of the updates.
2 Replies
Highlighted
Do you have the query? If you do you can add it to an Azure Monitor workbook for a visualization. You can create a scheduled Logic App if you need it to run weekly...happy to provide examples of both?

Logic app

Schedule trigger to Log Analytics Query to Send Email
Highlighted

@az_cloudadmin 

 

There's an example below on how to construct a query across multiple workspaces.  As you said they are under the same tenant then copy the format below:

 

union Update, workspace("contosoretail-it").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification


 

from the ms docs

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/cross-workspace-query

 

For the report part as the previous reply said, use function or logic app to trigger running the query at intervals, and use function+sendgrid or e-mail option in logicapp to mail it out.