Estate check

Find the resources in your exports that a tracked retirement, end of support date or breaking change applies to.

Only some tracked items have a match rule. An item without a rule is never matched, so a result with no matches does not prove that your estate is unaffected.

Runs in your browser. Nothing is uploaded.

Files are parsed locally. No file contents, names or IDs leave this page.

The check runs in your browser, so it needs JavaScript. Turn it on to add files. The export instructions below read without it.

Add your files

Drop files here or choose files

Resource Graph CSV
Resource Graph JSON
terraform show -json
ARM / Bicep JSON
.terraform.lock.hcl

Paste instead

Paste the content of one export

Try with sample files

Synthetic exports with made up names and IDs. Each one is fetched from this site when you press its button.

How to export

Azure Resource Graph

Run this query. The check reads these columns, so keep their names.

resources
| project id, name, type, kind, location, resourceGroup, subscriptionId,
    sku = tostring(sku.name), skuTier = tostring(sku.tier),
    vmSize = tostring(properties.hardwareProfile.vmSize),
    osImage = strcat(tostring(properties.storageProfile.imageReference.publisher), ':',
                     tostring(properties.storageProfile.imageReference.offer), ':',
                     tostring(properties.storageProfile.imageReference.sku)),
    k8sVersion = tostring(properties.currentKubernetesVersion),
    supportPlan = tostring(properties.supportPlan),
    linuxFxVersion = tostring(properties.siteConfig.linuxFxVersion),
    netFrameworkVersion = tostring(properties.siteConfig.netFrameworkVersion),
    pgVersion = tostring(properties.version),
    apiVersion = tostring(apiVersion)

Optional second query for App Service: the site configuration columns are not always filled in the first result. Export it as a second file and add it together with the first. The two files are merged by resource ID, so a site that is in both is counted once.

resources
| where type =~ 'microsoft.web/sites'
| project id, name, type, kind, location, resourceGroup, subscriptionId,
    linuxFxVersion = tostring(properties.siteConfig.linuxFxVersion),
    netFrameworkVersion = tostring(properties.siteConfig.netFrameworkVersion)

With the Azure CLI, put a query in place of <kql> and write the result to a JSON file. If you run both queries, change estate.json to a different file name for the second one:

az graph query -q "<kql>" --first 1000 -o json > estate.json

This command returns at most 1,000 resources. For a larger estate, run it again with --skip 1000, then --skip 2000 and so on (keep --first 1000), write each result to its own file, and add all the files.

In the Azure portal, open Resource Graph Explorer, run the query, then choose Download as CSV.

Terraform

Use the JSON output of terraform show for the state or for a saved plan (a raw state file is not read). The lock file .terraform.lock.hcl is read as it is. It lists provider versions only. A module version is set in the module block, so module releases are not checked here.

terraform show -json > tfstate.json
terraform show -json plan.tfplan > tfplan.json

ARM and Bicep

Use an ARM template JSON file, or the JSON that bicep build writes.