Get-AzureVMPatchComplianceReport

<#
.SYNOPSIS
    Reports patch compliance status across Azure VMs.

.DESCRIPTION
    Pulls the latest patch assessment for every VM enrolled in Azure
    Update Management and flags machines with pending critical or
    security classification updates, so patching gaps are visible
    tenant wide instead of VM by VM.

.EXAMPLE
    .\Get-AzureVMPatchComplianceReport.ps1

.NOTES
    Requires the Az.Compute module and an active Connect-AzAccount session.

.AUTHOR
    Shehryar Hassan
#>

$vms = Get-AzVM

$report = foreach ($vm in $vms) {
    $assessment = Get-AzVMPatchAssessmentResult -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -ErrorAction SilentlyContinue
    if ($assessment) {
        [pscustomobject]@{
            VMName          = $vm.Name
            LastAssessed    = $assessment.LastModifiedTime
            CriticalPending = ($assessment.AvailablePatches | Where-Object Classification -contains "Critical").Count
            SecurityPending = ($assessment.AvailablePatches | Where-Object Classification -contains "Security").Count
        }
    }
}

$report | Sort-Object CriticalPending -Descending | Format-Table -AutoSize