{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "slug": "dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it", "url": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/" }, "title": "Keep VM availability state separate from the annotation explaining it", "summary": "How should an Azure Resource Graph health query distinguish current VM state from failure context?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:39+00:00", "modified_at": "2026-09-10T00:35:08+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Operators building Azure VM availability investigations from Resource Graph HealthResources records.", "dse_recommendation": "Preserve the resource ID, observation time, availability state, and annotation context as separate fields.", "primary_source": { "name": "Virtual Machine (VM) availability information in Azure Resource Graph - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Resource Graph exposes the latest platform-assessed VM availability through availabilitystatuses and contextual details through resourceannotations. Unknown means the platform cannot accurately determine VM health, rather than confirming an outage. Annotations include downtime, informational, and degraded categories. Their context distinguishes platform-, user-, or VM-initiated activity; their planned/unplanned category does not apply to customer- or VM-initiated events. Microsoft Learn.

\n

Applicability

\n

Use this review when querying HealthResources for an Azure VM investigation or dashboard. Identify the affected VM and the interval being examined. Treat the latest status and an annotation’s occurrence time as separate observations, and avoid replacing an unknown or inapplicable value with an invented failure classification.

\n

DSE recommendation

\n

Preserve the resource ID, observation time, availability state, and annotation context as separate fields. Have the incident owner define how an Unknown state will prompt further checking without being counted automatically as confirmed downtime. Keep informational control-plane activity distinct from availability loss. Correlate the platform record with the application’s own evidence before attributing a user-visible incident to a particular operation.

\n

Verification

\n

Test the query against representative available, unavailable, unknown, and annotated records. Inspect whether null or inapplicable category values remain distinguishable from planned and unplanned activity. Compare the output with the underlying source record and the application’s timeline. Retain conflicting observations for investigation rather than forcing them into a single status merely to simplify a dashboard or incident summary.

\n

Official references

\n

Microsoft Learn: VM availability information in Azure Resource Graph. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Resource Graph exposes the latest platform-assessed VM availability through availabilitystatuses and contextual details through resourceannotations. Unknown means the platform cannot accurately determine VM health, rather than confirming an outage. Annotations include downtime, informational, and degraded categories. Their context distinguishes platform-, user-, or VM-initiated activity; their planned/unplanned category does not apply to customer- or VM-initiated events. Microsoft Learn.\nApplicability\nUse this review when querying HealthResources for an Azure VM investigation or dashboard. Identify the affected VM and the interval being examined. Treat the latest status and an annotation’s occurrence time as separate observations, and avoid replacing an unknown or inapplicable value with an invented failure classification.\nDSE recommendation\nPreserve the resource ID, observation time, availability state, and annotation context as separate fields. Have the incident owner define how an Unknown state will prompt further checking without being counted automatically as confirmed downtime. Keep informational control-plane activity distinct from availability loss. Correlate the platform record with the application’s own evidence before attributing a user-visible incident to a particular operation.\nVerification\nTest the query against representative available, unavailable, unknown, and annotated records. Inspect whether null or inapplicable category values remain distinguishable from planned and unplanned activity. Compare the output with the underlying source record and the application’s timeline. Retain conflicting observations for investigation rather than forcing them into a single status merely to simplify a dashboard or incident summary.\nOfficial references\nMicrosoft Learn: VM availability information in Azure Resource Graph. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Resource Graph exposes the latest platform-assessed VM availability through availabilitystatuses and contextual details through resourceannotations. Unknown means the platform cannot accurately determine VM health, rather than confirming an outage. Annotations include downtime, informational, and degraded categories. Their context distinguishes platform-, user-, or VM-initiated activity; their planned/unplanned category does not apply to customer- or VM-initiated events. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability).\n\n## Applicability\n\nUse this review when querying HealthResources for an Azure VM investigation or dashboard. Identify the affected VM and the interval being examined. Treat the latest status and an annotation’s occurrence time as separate observations, and avoid replacing an unknown or inapplicable value with an invented failure classification.\n\n## DSE recommendation\n\nPreserve the resource ID, observation time, availability state, and annotation context as separate fields. Have the incident owner define how an Unknown state will prompt further checking without being counted automatically as confirmed downtime. Keep informational control-plane activity distinct from availability loss. Correlate the platform record with the application’s own evidence before attributing a user-visible incident to a particular operation.\n\n## Verification\n\nTest the query against representative available, unavailable, unknown, and annotated records. Inspect whether null or inapplicable category values remain distinguishable from planned and unplanned activity. Compare the output with the underlying source record and the application’s timeline. Retain conflicting observations for investigation rather than forcing them into a single status merely to simplify a dashboard or incident summary.\n\n## Official references\n\n[Microsoft Learn: VM availability information in Azure Resource Graph](https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "url": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep VM availability state separate from the annotation explaining it", "item": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "url": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/", "headline": "Keep VM availability state separate from the annotation explaining it", "description": "How should an Azure Resource Graph health query distinguish current VM state from failure context?", "abstract": "How should an Azure Resource Graph health query distinguish current VM state from failure context?", "articleBody": "Source facts\nAzure Resource Graph exposes the latest platform-assessed VM availability through availabilitystatuses and contextual details through resourceannotations. Unknown means the platform cannot accurately determine VM health, rather than confirming an outage. Annotations include downtime, informational, and degraded categories. Their context distinguishes platform-, user-, or VM-initiated activity; their planned/unplanned category does not apply to customer- or VM-initiated events. Microsoft Learn.\nApplicability\nUse this review when querying HealthResources for an Azure VM investigation or dashboard. Identify the affected VM and the interval being examined. Treat the latest status and an annotation’s occurrence time as separate observations, and avoid replacing an unknown or inapplicable value with an invented failure classification.\nDSE recommendation\nPreserve the resource ID, observation time, availability state, and annotation context as separate fields. Have the incident owner define how an Unknown state will prompt further checking without being counted automatically as confirmed downtime. Keep informational control-plane activity distinct from availability loss. Correlate the platform record with the application’s own evidence before attributing a user-visible incident to a particular operation.\nVerification\nTest the query against representative available, unavailable, unknown, and annotated records. Inspect whether null or inapplicable category values remain distinguishable from planned and unplanned activity. Compare the output with the underlying source record and the application’s timeline. Retain conflicting observations for investigation rather than forcing them into a single status merely to simplify a dashboard or incident summary.\nOfficial references\nMicrosoft Learn: VM availability information in Azure Resource Graph. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:39+00:00", "dateModified": "2026-09-10T00:35:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep VM availability state separate from the annotation explaining it" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Virtual Machine (VM) availability information in Azure Resource Graph - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability" } } ] } }