求可用KQL左外连接查询：提取Azure磁盘合规性报告

以下是实现左外连接磁盘资源与合规策略状态的完整KQL代码，可提取所有不合规磁盘的核心属性及具体不合规原因：

Resources
| where type == 'microsoft.compute/disks'
| project 
    diskId = id, 
    diskName = name, 
    resourceGroup, 
    location, 
    diskSizeGB = properties.diskSizeGB, 
    osType = properties.osType
| kind leftouter join (
    PolicyStates
    | where type == 'microsoft.policyinsights/policystates'
    | where complianceState == 'NonCompliant'
    | project 
        resourceId, 
        policyAssignmentName, 
        policyDefinitionName, 
        nonComplianceReason = properties.nonComplianceMessage.message, 
        nonComplianceDetails = properties.nonComplianceMessage.details
) on $left.diskId == $right.resourceId
// 若需保留所有磁盘（含合规），可移除下方where条件
| where isnotempty(policyAssignmentName)
| project 
    diskName, 
    resourceGroup, 
    location, 
    osType, 
    diskSizeGB, 
    policyAssignmentName, 
    policyDefinitionName, 
    nonComplianceReason, 
    nonComplianceDetails

关键说明： #

• 关联逻辑：通过资源唯一ID（diskId对应resourceId）实现左外连接，确保磁盘资源作为主表被完整保留
• 筛选优化：子查询中提前过滤NonCompliant状态的策略记录，减少不必要的数据关联
• 字段扩展：若nonComplianceDetails为数组结构，可添加mv-expand nonComplianceDetails语句展开详情内容
• 灵活调整：移除where isnotempty(policyAssignmentName)后，可查看所有磁盘的合规状态（合规磁盘的策略字段将显示为null）

内容的提问来源于stack exchange，提问作者kpgkondo