ARG

01.kql

resources
| where array_length(properties.privateEndpointConnections) > 0
| project resourceId = id, resourceName = name, resourceEnum = type, connection = properties.privateEndpointConnections, resourceLocation = location, resourceSubscriptionId = tolower(subscriptionId)
| mvexpand connection // usually just removes array wrapper from connection
| extend id = connection.id| extend name = tostring(split(id, "/")[10])
| extend privateEndpointId = connection.properties.privateEndpoint.id
| extend privateEndpointSubscriptionId = tolower(split(connection.properties.privateEndpoint.id, "/")[2])
| extend endpointName = tostring(split(privateEndpointId, "/")[8])
| extend description = tostring(connection.properties.privateLinkServiceConnectionState.description)
| extend status = connection.properties.privateLinkServiceConnectionState.status
| join kind=leftouter  ( 
resourcecontainers
| where ['type'] == "microsoft.resources/subscriptions"
| project subscriptionId = tolower(subscriptionId), subscriptionName = name
) on $left.privateEndpointSubscriptionId == $right.subscriptionId
|where subscriptionName == ""