Azure

Resource health through Azure Rest API

As a part of a large monitoring project involving on prem, Azure and Office 365 I have started to explore the different methods on how to acquire all relevent data. Previously, I have written a post on how you authenticate against Microsoft’s partner center API which is a part of the same feasibility project.
Later down the road i will try to write a larger blog series on how we can monitor Microsoft Cloud and on-Prem resources. Hopefully it will be joyful…

This blog post will describe how you can use Powershell to authenticate and get availability status from all resource groups and their resources. If you’re not that interested in monitoring data, use this post as a guide on how to get started with the API and the rest is documented on the Azure API documentation pages.

High level overview:

  • Set up an Azure Active Directory Application to authenticate (not covered)
  • Build an authentication header with a token from Azure AD
  • Get all resource groups within a subscription
  • Get the availability of all resources within a resource group

 

Get Azure AD application token

After setting up/registering the application in Azure AD you will have to use the application ID and secret in order to generate an authentication token to use against Azure management Rest API’s. I have created a basic Powershell function you can use, including an example authentication header.

Get all resource groups and resources

Next we will grab all resource groups within a subscription, before looping through each resource group to get the individual resources.

Now that we have all resource group and all resources within we can use this to further get the resource health and availability. To be honest we don’t need to get RG before checking the resources it self, but as a starting point i find it very useful to have the resource groups and their resources available within my scripts.

 

Get the resource availability status

Now we have authenticated, grabbed all resource groups and their resources and it’s time to find our resource health. There are multiple ways on how to get this data, and we have to consider the methods we use. One limitation i hit pretty fast working with this is the number of subscription resource get requests, specified in the response header “x-ms-ratelimit-remaining-subscription-resource-requests: ” All limitations documentet,  here 

When you hit this limit every substantial requests is dropped. I have to rethink my whole monitoring scenario due to these limitations.

Get Resource health based on resource group

This let’s us get health state on all resources scoped to a resource group. If we reuse the data from previously (we have all resource groups within our subscription) we will get all resource group health this way.

Other examples are to get availability by Resource and the entire subscription

 

 

 

Martin Ehrnst
Technical Lead for Azure at Intility
IT Pro with a passion for monitoring. Working with System Center, OMS, Azure and related software and cloud services.

Direct customer experience from previously being a Technical Account Manager.

Community supporter where I try to contribute via blogging and social media.

11 COMMENTS
  • Lucas Alvarez Lacasa
    Reply

    Hey Martin!. Can you cover the first part? I cannot find how to properly register my application in the Azure portal. I have followed this tutorial but with .NET Core and I’m getting a forbidden every time I perform the request.
    The authentication token is coming as expected, the problem arises when I query the Resource Health API. I think this is because I cannot find a way to tell the application that it should have permissions to read from this API. How did you do this in the Azure portal?

    Thanks, Lucas!.

    1. Martin Ehrnst
      Reply

      Hi Lucas,

      You have to add the Azure Management API’s to you application.
      The process is described here: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-integrating-applications#configure-a-client-application-to-access-web-apis

      1. Lucas Alvarez Lacasa
        Reply

        Hello Martin!. Thanks for replying so fast.
        Yeah, I already checked on that link earlier today. The problem is that I don’t know which API I need to enable for the Resource Health Api.
        I wish I could send you an image of what I see in the Azure portal when I go to the possible APIs for the application that I register, but nothing related to Resource Health Api is found in the list.

        1. Martin Ehrnst
          Reply

          It should be azure management something

          1. Lucas Alvarez Lacasa

            The only options that include management that I can see are: Microsoft Rights Management Services (Microsoft.Azure.RMS), Windows Azure Service Management API and Office 365 Management APIs.
            I will try with the second one, since it’s the one that looks more related to what I’m trying to accomplish.

            It would be nice if Microsoft included some documentation about this small details.

          2. Lucas Alvarez Lacasa

            Adding Windows Azure Service Management API permissions didn’t make the trick, I’m still getting a forbidden when trying to query the Resource Health Api.

            Let me know if you remember how you did it.

            Thanks!.

          3. Martin Ehrnst

            Hey. That’s strange. Try to upload a few pics of your configuration somewhere and post the links

          4. Martin Ehrnst

            Lucas, do the app have ‘reader’ permissions on the subscription level?

          5. Lucas Alvarez Lacasa

            Hello Martin, after many tries I was finally able to communicate with the API. The issue was produced by how I was obtaining the authentication token.
            Now it’s working fine 🙂 Thank you.

  • Sam Lord
    Reply

    Hey Martin! All the code samples are centred, what’s happening?

    I wonder how difficult it is to do the token requests without the Azure PowerShell commandlets 😉

    1. Martin Ehrnst
      Reply

      Ooops, whats with this CSS, i’ll look in to it, but in the mean time you can copy the code or view it on github directly 🙂 https://gist.github.com/ehrnst/a8db76bce82cc48f29165a01af95b077#file-get-aadappoauthtoken-ps1

      The easiest is to use the powershell module 🙂 but if you cannot use that, the REST API is a good canditate.
      I think i know what you are saying and I’ll give it at try soon 🙂

Engage by commenting