fix: Improve KQL stability for resource group recommendation

azure-resources/Resources/resourceGroups/kql/98bd7098-49d6-491b-86f1-b143d6b1a0ff.kql

@@ -1,13 +1,22 @@
 // Azure Resource Graph Query
 // Provides a list of Azure Resource Groups that have resources deployed in a region different than the Resource Group region
-resources
-| project id, name, tags, resourceGroup, location
-| where location != "global"                                                                                                          // exclude global resources
-| where resourceGroup != "networkwatcherrg"                                                                                           // exclude networkwatcherrg
-| where split(id, "/", 3)[0] =~ "resourceGroups"                                                                                      // resource is in a resource group
-| extend resourceGroupId = strcat_array(array_slice(split(id, "/"),0,4), "/")                                                         // create resource group resource id
-| join (resourcecontainers | project containerid=id, containerlocation=location ) on $left.resourceGroupId == $right.['containerid']  // join to resourcecontainers table
-| where  location != containerlocation
-| project recommendationId="98bd7098-49d6-491b-86f1-b143d6b1a0ff", name, id, tags
-| order by id asc
-
+resourcecontainers
+| where type =~ "Microsoft.Resources/subscriptions/resourceGroups"
+| project resourceGroupId = tolower(id), resourceGroupLocation = location
+| join kind = inner (
+    resources
+    | where location !~ "Global" and             // Exclude global resources
+        resourceGroup !~ "NetworkWatcherRG" and  // Exclude resources in the NetworkWatcherRG
+        id has "/resourceGroups/"                // Exclude resources not in a resource group
+    | project id, name, tags, resourceGroup, location, resourceGroupId = tolower(strcat_array(array_slice(split(id, "/"), 0, 4), "/"))
+    )
+    on resourceGroupId
+| where resourceGroupLocation !~ location
+| project
+    recommendationId = "98bd7098-49d6-491b-86f1-b143d6b1a0ff",
+    name,
+    id,
+    tags,
+    param1 = strcat("resourceLocation: ", location),
+    param2 = strcat("resourceGroupLocation: ", resourceGroupLocation),
+    param3 = strcat("resourceGroup: ", resourceGroup)