Unattached disks Azure resource graph KQL query

unattached-disks.kql

resources
| where type =~ 'microsoft.compute/disks'
| where tostring(properties.diskState) =~ 'Unattached'
| where isempty(managedBy)
// Exclude Azure Site Recovery replica disks, which are unattached by design
| where isnull(tags['ASR-ReplicaDisk']) and name !endswith '-ASRReplica'
| extend
    skuName      = tostring(sku.name),
    sizeGB       = toint(properties.diskSizeGB),
    created      = todatetime(properties.timeCreated),
    lastDetached = todatetime(properties.LastOwnershipUpdateTime),
    owner        = tostring(tags['owner'])
| extend daysUnattached = datetime_diff('day', now(), coalesce(lastDetached, created))
| where daysUnattached >= 30
| join kind=leftouter (
    resourcecontainers
    | where type =~ 'microsoft.resources/subscriptions'
    | project subscriptionId, subscriptionName = name
  ) on subscriptionId
| project subscriptionName, resourceGroup, name, skuName, sizeGB, location,
          created, lastDetached, daysUnattached, owner, id
| order by sizeGB desc