Microsoft Azure – Find Orphaned Network Interface Cards(NICs)

In this article, you will see that how to find the unattached NICs also known as Azure Orphaned NICs. The main objective or purpose of deleting the orphaned resources is to save the cost. When you delete a VM in Azure, the NIC attached to the VMs will only be disassociated but it will not be deleted automatically and they will be left as Orphaned NICs.

Implementation:

Step 1: Log in to Azure Portal.

Step 2: Go to Azure Resource Graph Explorer >> select the Resource Graph Explorer

Step 3: Select Scope >> Subscription >> Select your subscriptions (You can select single or multiple subscriptions of your choice at once)

Step 4: Paste the below query in the query box and click on the Run query to get the list/report of unattached NICs.

• KQL Resource Graph Query: To get the complete details of Orphaned NICs from the select scope.

Resources
| where type has "microsoft.network/networkinterfaces"
| where "{nicWithPrivateEndpoints}" !has id
| where properties !has 'virtualmachine'

Output:

• KQL Resource Graph Query: Find Orphaned NICs only from Select Subscription

Resources
| where type has "microsoft.network/networkinterfaces"
| where "{nicWithPrivateEndpoints}" !has id
| where properties !has 'virtualmachine'
| where subscriptionId == "" //provide SubscriptionId here if you have selected multiple Subscriptions
| project name, location, subscriptionId, resourceGroup

Output:

• KQL Resource Graph Query: For finding all the Orphaned NICs with Tag name “environmentName” has some value either equal to not equal to.

Resources
| where type has "microsoft.network/networkinterfaces"
| where "{nicWithPrivateEndpoints}" !has id
| where properties !has 'virtualmachine'
| where tags.Environment != "Production"
| project name, location, subscriptionId, resourceGroup, tags

Output: