# Keep VM availability state separate from the annotation explaining it

> How should an Azure Resource Graph health query distinguish current VM state from failure context?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:30:39+00:00
- Modified: 2026-09-10T00:35:08+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

How should an Azure Resource Graph health query distinguish current VM state from failure context?

## Potentially affected

Operators building Azure VM availability investigations from Resource Graph HealthResources records.

## DSE recommendation

Preserve the resource ID, observation time, availability state, and annotation context as separate fields.

## Article

## Source facts

Azure Resource Graph exposes the latest platform-assessed VM availability through availabilitystatuses and contextual details through resourceannotations. Unknown means the platform cannot accurately determine VM health, rather than confirming an outage. Annotations include downtime, informational, and degraded categories. Their context distinguishes platform-, user-, or VM-initiated activity; their planned/unplanned category does not apply to customer- or VM-initiated events. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability).

## Applicability

Use this review when querying HealthResources for an Azure VM investigation or dashboard. Identify the affected VM and the interval being examined. Treat the latest status and an annotation’s occurrence time as separate observations, and avoid replacing an unknown or inapplicable value with an invented failure classification.

## DSE recommendation

Preserve the resource ID, observation time, availability state, and annotation context as separate fields. Have the incident owner define how an Unknown state will prompt further checking without being counted automatically as confirmed downtime. Keep informational control-plane activity distinct from availability loss. Correlate the platform record with the application’s own evidence before attributing a user-visible incident to a particular operation.

## Verification

Test the query against representative available, unavailable, unknown, and annotated records. Inspect whether null or inapplicable category values remain distinguishable from planned and unplanned activity. Compare the output with the underlying source record and the application’s timeline. Retain conflicting observations for investigation rather than forcing them into a single status merely to simplify a dashboard or incident summary.

## Official references

[Microsoft Learn: VM availability information in Azure Resource Graph](https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability). Source reviewed September 9, 2026.

## Primary reference

- Name: Virtual Machine (VM) availability information in Azure Resource Graph - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/resource-graph-availability
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep VM availability state separate from the annotation explaining it,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-077-keep-vm-availability-state-separate-from-the-annotation-explaining-it/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.