subscriptions
Summary
Details
Do not create more than 2000 Citrix VDA servers per subscription
Impact: High Category: Governance
APRL GUID: c041d596-6c97-4c5f-b4b3-9cd37628f2e2
Description:
A Citrix Managed Azure subscription supports VMs with VDA for app/desktop delivery, excluding other machines like Cloud Connectors. When close to the limit, signaled by a dashboard notification, and with sufficient licenses, request another subscription. Can't exceed the given limits for catalogs.
Potential Benefits:
Avoids hitting limit, ensures reliability
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// Azure Resource Graph Query
// Count VM instances with a tag that contains "Citrix VDA" and create output if that count is >2000 for each subscription.
// The Citrix published limit is 2500. This query runs an 80% check.
resources
| where type == 'microsoft.compute/virtualmachines'
| where tags contains 'Citrix VDA'
| summarize VMs=count() by subscriptionId
| where VMs > 2000
| join (resourcecontainers| where type =='microsoft.resources/subscriptions' | project subname=name, subscriptionId) on subscriptionId
| project recommendationId='c041d596-6c97-4c5f-b4b3-9cd37628f2e2', name= subname, id = subscriptionId, param1='Too many instances.', param2= VMs
Configure Service Health Alerts
Impact: High Category: Monitoring and Alerting
APRL GUID: 9729c89d-8118-41b4-a39b-e12468fa872b
Description:
Service health gives a personalized health view of Azure services and regions used, offering the best place for notifications on outages, planned maintenance, and health advisories by knowing the services used.
Potential Benefits:
Proactive outage and maintenance alerts
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// Azure Resource Graph Query
// This resource graph query will return all subscriptions without Service Health alerts configured AND subscriptions with Service Health alerts only configured with specific configuration (which requires manual verification regarding the scope being covered by this rule)
resourcecontainers
| where type == 'microsoft.resources/subscriptions'
| project subscriptionId = id, subscriptionName = name, tags
| join kind=leftouter (
resources
| where type == "microsoft.insights/activitylogalerts" and properties.condition contains "ServiceHealth"
| extend shaRuleType = iff(array_length(properties.condition.allOf) > 1, 'Explicit','All')
| project subscriptionId = strcat('/subscriptions/',subscriptionId), name, shaRuleType
| summarize shaAllRuleCount = countif(shaRuleType == 'All'), shaExplicitRuleCount = countif(shaRuleType == 'Explicit') by subscriptionId
) on subscriptionId
| extend shaStatus = iff(isnull(shaAllRuleCount) and isnull(shaExplicitRuleCount), 'Not configured',iff(shaAllRuleCount >= 1, 'Configured', 'Explicit'))
| where shaStatus != 'Configured'
| project recommendationId = "9729c89d-8118-41b4-a39b-e12468fa872b", name = subscriptionName, id= subscriptionId, tags, param1 = iff(shaStatus == 'Explicit', 'Explicit only Service Health Alert Rule(s) found. Please verify that the expected scope is covered by these rule(s).','No Service Health Alert Rule found.')
Ensure Resource Group and its Resources are located in the same Region
Impact: High Category: Disaster Recovery
APRL GUID: 98bd7098-49d6-491b-86f1-b143d6b1a0ff
Description:
Ensure resource locations align with their resource group to manage resources during regional outages. ARM stores resource data, which if in an unavailable region, could halt updates, rendering resources read-only.
Potential Benefits:
Improves outage management
Learn More:
ARG Query:
Click the Azure Resource Graph tab to view the query
// Azure Resource Graph Query
// Provides a list of Azure Resource Groups that have resources deployed in a region different than the Resource Group region
resourcecontainers
| where type =~ "Microsoft.Resources/subscriptions/resourceGroups"
| project resourceGroupId = tolower(id), resourceGroupLocation = location
| join kind = inner (
resources
| where location !~ "Global" and // Exclude global resources
resourceGroup !~ "NetworkWatcherRG" and // Exclude resources in the NetworkWatcherRG
id has "/resourceGroups/" // Exclude resources not in a resource group
| project id, name, tags, resourceGroup, location, resourceGroupId = tolower(strcat_array(array_slice(split(id, "/"), 0, 4), "/"))
)
on resourceGroupId
| where resourceGroupLocation !~ location
| project
recommendationId = "98bd7098-49d6-491b-86f1-b143d6b1a0ff",
name,
id,
tags,
param1 = strcat("resourceLocation: ", location),
param2 = strcat("resourceGroupLocation: ", resourceGroupLocation),
param3 = strcat("resourceGroup: ", resourceGroup)