How To Fetch Your Subscription Snapshots in Microsoft Azure?

Pre-requisite: Azure

An Azure Snapshot is a read-only copy of an Azure disk. It is a point-in-time copy of a disk that can be used to create new disks or restore data from a previous state. Snapshots can be used to back up data, recover from accidental deletion, or roll back to a previous version of a disk. Snapshots can be managed through the Azure Portal, Azure PowerShell, or Azure CLI.

Here in this article, we will show you How we can track the azure snapshots which are older than 30 days from current data from now. To track this information we can make use of azure resource graph explorer by running some customized all resource graph queries and also export the list in CSV.

Step 1: Log in to Azure Portal

Step 2: Access the Resource Graph Explorer from Azure Global Search.

Step 3: Once you open the Resource Graph Explorer >> Select the target azure subscription and add the following KQL resource graph query in the query section >> click on Run query.

Here in this KQL, we are finding snapshots older than 30 days and above.

Resources
| where type =~ 'Microsoft.Compute/snapshots'
| extend TimeCreated = properties.timeCreated
| where TimeCreated < now(-30d)

This query returns the following results. Refer to the sample output below:

Step 4: To add more filters to the above query using the following KQL query.

Resources
| where type =~ 'Microsoft.Compute/snapshots'
| extend TimeCreated = properties.timeCreated
| where TimeCreated < now(-30d)
| project TimeCreated, name, resourceGroup, location

This query returns filtered results based on projected keywords. Refer to the sample output below:

That’s it. This is the process of tracking older snapshots in an azure subscription using these kql resource graph queries.