Azure Lighthouse related issue - when running for two delated subscriptions with same Tenant - it only picks up one

[prashantnayak]

🐛 Problem

TODO: Customer provided access to two subscriptions (ex: contoso-prod and contoso-core) under same tenant via Azure Lighhouse.

👣 Repro steps

1. Start PS command prompt
2. Run Az login
3. After login selected one of the Customer delegated subscriptions (ex contoso-core)
4. Ran all usual commands (Invoke-WebRequest -Uri https://aka.ms/acorl/tools/costcollector -OutFile collectCostRecommendations.ps1 and .\collectCostRecommendations.ps1 -verbose"
5. I scope it to MyScope.json file where I am only mentioning target subscription (contoso-core)
6. It doesn't pick up any recommendation despite I see that there are Advisor recommendation in the subscription

🤔 Expected

It should output recommendations for that subscriptions in a CSV file but it doesn't output only manual recommendations.

📷 Screenshots

ℹ️ Additional context

Additionally, when I use entire scope, it picks up all subscription (including @microsoft.com and also contoso-prod) but it doesn't pick up contoso-core. It's really weird. I tried restart PS, it tried with 4 other SMEs over my shoulder but it's not picking up recommendations from contoso-core, whatsoever.

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Leave comments to help us solidify the vision.

[microsoft-github-policy-service]

Thank you for submitting this issue! We try to respond within 3 business days. In the meantime:

• 📖 Check the troubleshooting guide for common issues
• 💬 Ask questions in Discussions
• 📅 Join our biweekly office hours for live help from the team

[prashantnayak]

Appreciate if someone can look urgently, thx.

[flanakin]

@arthurclares Are you still supporting this?

[prashantnayak]

@arthurclares I posted this in our internal Team chat as well... Please let me know if you need any further assistance reproducing this.

[flanakin]

@DirkBrinkmann Are you taking this over by any chance?

[flanakin]

@arthurclares The problem seems to be that Search-AzGraph is being called without the -Subscription parameter and relying on the default context to determine which subscriptions to query.

When multiple subscriptions from the same tenant are delegated via Lighthouse, ARG doesn't automatically include all of them unless you explicitly specify which subscriptions to query using the -Subscription parameter.

Currently, the subscription IDs from the JSON scope file are only used in KQL where clauses to filter results, but they're not passed to Search-AzGraph to control which subscriptions are actually queried in the first place.

The fix would be to:

1. Extract the subscription IDs from $ScopeObject or $allSubscriptionIds
2. Pass them to Search-AzGraph calls via the -Subscription parameter (lines 210, 215, 406)
3. Handle the "Entire Environment" case by explicitly listing all accessible subscriptions via Get-AzSubscription

Example:

# Instead of:
$resultPage = Search-AzGraph -Query $query -First 1000

# Do:
$subscriptionIds = @($scope.IndividualScopes | ForEach-Object { $_.SubscriptionId } | Select-Object -Unique)
$resultPage = Search-AzGraph -Query $query -First 1000 -Subscription $subscriptionIds

This needs to be applied to all Search-AzGraph calls, including those inside the ForEach-Object -Parallel blocks where you'd need to pass the subscription list via $using:.

Let me know if you'd like help implementing this or if you're still supporting this script.

[flanakin]

@prashantnayak Thanks for the detailed report. I think I see the issue with how ARG queries delegated subscriptions.

Workaround:

The script uses your JSON scope file to filter results, but it doesn't explicitly tell ARG which subscriptions to query. I'm not totally familiar with this, but you might be able to try this:

1. Before running the script, explicitly set your Azure context to the subscription that's being missed:

   Set-AzContext -Subscription "contoso-core"

2. Then run the script with your scope JSON file as usual

3. If you need recommendations from both subscriptions, you may need to run the script twice (once for each subscription) and combine the Excel outputs

Alternative workaround:

If you're comfortable with PowerShell, you can try this manual fix to the script:

Edit CostRecommendations.ps1 at line 210 and 215, and change:

$resultPage = Search-AzGraph -Query $query -First 1000 -ErrorAction Stop

To:

# Get subscription IDs from your scope
$subIds = @($using:ScopeObject.IndividualScopes | ForEach-Object { $_.SubscriptionId } | Select-Object -Unique)
$resultPage = Search-AzGraph -Query $query -First 1000 -Subscription $subIds -ErrorAction Stop

This should force ARG to query the specific subscriptions you've defined in your scope file rather than relying on the default context.

Let us know if the workaround helps!