ARM Kusto Investigation

Use internal Azure Resource Manager (ARM) request logs to reconstruct control-plane operations and identify where a request failed or spent time. This skill applies to any Azure resource provider; do not assume the affected service, provider, or resource type in advance.

Use aro-kusto for Kusto schema discovery, query execution, and ADX links. This skill supplies the ARM-specific investigation workflow and query patterns.

Inputs

Collect as many of these as are available:

• UTC time window, kept as narrow as practical
• ARM correlation ID, activity ID, client request ID, or service request ID
• subscription, resource group, resource ID, deployment name, or operation name
• failed status, error code, and error message
• a successful retry or comparison operation