• Azure
• KqlKustoLogs
• AzureMarketPlaceImageUsed

Azure/KqlKustoLogs/AzureMarketPlaceImageUsed

* https://learn.microsoft.com/en-us/azure/virtual-machines/deprecated-images#how-can-i-identify-the-virtual-machines-and-virtual-machine-scale-sets-in-my-subscription-that-are-running-on-images-that-are-scheduled-for-deprecation

resources 
|where type == "microsoft.compute/virtualmachines" 
//| where properties.storageProfile.imageReference.publisher =~ 'Windows' //optional filter, uncomment this line to filter for a specific publisher.
//| where properties.storageProfile.imageReference.sku =~ '2016-Datacenter' //optional filter, uncomment this line to filter for a specific deprecated SKU (Plan).
//| where properties.storageProfile.imageReference.version == '14393.4467.2106061537' //optional filter, uncomment this line to filter for a specific deprecated version.
| where isnull(properties.storageProfile.imageReference.publisher) == false
|project name, subscriptionId, resourceGroup,
    ImagePublisher=properties.storageProfile.imageReference.publisher,
    ImageOffer=properties.storageProfile.imageReference.offer,imageSku=properties.storageProfile.imageReference.sku,
    imageVersion=properties.storageProfile.imageReference.exactVersion