How do I know which image version is installed on a specific instance of an Azure VMSS?

If the image gallery is configured to install the latest image on new instances, the image version can potentially vary between instances. The actually installed version of an image is stored in the storageProfile.imageReference.exactVersion property of the vmss object.

Listing the installed image version for a specific machine in an existing scale set:

az vmss show --resource-group "<resource group name>" \
  --subscription "<subscription name>" \
  --name <vmss name> \
  --instance-id <instance id> \
  --query storageProfile.imageReference.exactVersion

The reply matches the version number defined in the image gallery:

"2021.06.1782103"

If the instance id is not known, it is possible to get all instance ids of an existing scale set:

az vmss list-instances --resource-group "<resource group name>" \
  --subscription "<subscription name>" \
  --name <vmss name> \
  --query [].instanceId

[
  "1141",
  "1142",
  "1143"
]

To further simplify things, one could list the installed image version for each machine in an existing scale set. This allows, for example, to see if all instances are at the same version or one is left behind:

az vmss list-instances --resource-group "<resource group name>" \
  --subscription "<subscription name>" \
  --name <vmss name> \
  --query [].storageProfile.imageReference.exactVersion

In an example with 3 instances the reply may indicate that two machines are on the later version (...03), and one machine is still on an older version of the image (...02):

[
  "2021.06.1782102",
  "2021.06.1782103",
  "2021.06.1782103"
]

Finally, to combine this one can also query for instanceId and installed image version at the same time:

az vmss list-instances --resource-group "<resource group name>" --subscription "<subscription name>" --name <vmss name> --query "[].[instanceId,storageProfile.imageReference.exactVersion]"
[
  [
    "1141",
    "2021.06.1782102"
  ],
  [
    "1142",
    "2021.06.1782103"
  ],
  [
    "1143",
    "2021.06.1782103"
  ]
]

You can get the exect version of image reference for one specfic instance by using the Get-AzVmssVM cmdlet with the following sytax:

(Get-AzVmssVM -ResourceGroupName $rgName -Name $ScaleSetName -InstanceId $instanceId).StorageProfile.ImageReference