Find Unattached and Orphaned Disks in Azure With Kusto

This blog post will show how to find Virtual machine disks that are not attached to a VM or are being used using the Kusto query language.

Virtual machine disks contribute to almost 50% of the overall cost of any VM if the disks are SSD-based. When disks are left unmanaged and not deleted, they can contribute to higher subscription costs.

Resource Graph Manager

Using Kusto Query Language (KQL), we can analyze large volumes of data, and in our case, we can find virtual disks that are not attached to virtual machines. To use Kusto, Open Resource Graph Explorer from the Azure portal.

In the query window, paste the following code and run.

Resources  
| where type contains "microsoft.compute/disks" 
| extend diskState = tostring(properties.diskState)
| where managedBy == ""
    or diskState == 'Unattached'
| project id, diskState, resourceGroup, location, subscriptionId

After running the query, you will see all the unattached disks.