Azure Resource Graph · KQL library

Find Azure resources before you make a change

Search read-only KQL queries for access, exposure, tags, diagnostics, backup, recent changes, and inventory. KQL (Kusto Query Language) lets you inspect Azure resources and configuration evidence across the Azure scope you can read.

Search KQL by question

Start with the problem you are investigating—not a blank query editor.

Inspect evidence at scale

Use one KQL query to review resources across accessible subscriptions and groups.

Continue safely

Interpret the KQL output, then open a related runbook, command, or study path.

A glowing magnifying glass inspecting connected Azure resource nodes
Read-only discovery before configuration change
Why this page exists

KQL turns a scattered Azure estate into evidence you can review.

Azure resources are spread across subscriptions, resource groups, providers, and portals. This library gives you reusable Azure Resource Graph KQL so you can answer inventory and troubleshooting questions quickly before you change production. Nothing runs against your tenant from AzureGlossary; you copy the KQL and run it in your own Azure Resource Graph Explorer or Azure CLI session.

  1. 1
    Describe the questionSearch for “public IPs,” “missing owner tags,” “RBAC,” “backup,” or another outcome.
  2. 2
    Copy the KQLReview the table, scope, and fields before running the query.
  3. 3
    Run it in AzureUse Resource Graph Explorer or az graph query -q "...".
  4. 4
    Interpret before actingConfirm scope and open the related runbook before making a change.
KQL starter kit

Useful KQL you can copy immediately

These compact Azure Resource Graph KQL queries cover the first inventory and risk checks most people need.

where filter project choose columns extend create fields summarize aggregate order by sort
InventoryCount resources by type
Resources
| summarize resourceCount = count() by type
| order by resourceCount desc
OwnershipResources missing an owner tag
Resources
| where isempty(tostring(tags['owner']))
| project name, type, resourceGroup, subscriptionId, location
| order by type asc
NetworkingPublic IP address inventory
Resources
| where type =~ 'microsoft.network/publicipaddresses'
| project name, resourceGroup, subscriptionId, location,
          ipAddress = tostring(properties.ipAddress),
          allocation = tostring(properties.publicIPAllocationMethod)
| order by name asc
AccessRole assignment inventory
AuthorizationResources
| where type =~ 'microsoft.authorization/roleassignments'
| extend principalType = tostring(properties.principalType),
         principalId = tostring(properties.principalId),
         roleDefinitionId = tostring(properties.roleDefinitionId)
| project assignmentResourceId = id, principalType, principalId,
          roleDefinitionId, subscriptionId
| order by principalType asc
ComputeVirtual machines by OS and size
Resources
| where type =~ 'microsoft.compute/virtualmachines'
| project name, resourceGroup, location,
          osType = tostring(properties.storageProfile.osDisk.osType),
          vmSize = tostring(properties.hardwareProfile.vmSize)
| order by name asc
HealthVM availability state by subscription
HealthResources
| where type =~ 'microsoft.resourcehealth/availabilitystatuses'
| summarize resourceCount = count()
    by subscriptionId,
       availabilityState = tostring(properties.availabilityState)
| order by subscriptionId asc
SchemaAPI version used for each resource type
Resources
| distinct type, apiVersion
| where isnotnull(apiVersion)
| order by type asc
StorageStorage public access and TLS posture
Resources
| where type =~ 'microsoft.storage/storageaccounts'
| project name, resourceGroup, location,
          allowBlobPublicAccess = tobool(properties.allowBlobPublicAccess),
          minimumTlsVersion = tostring(properties.minimumTlsVersion),
          publicNetworkAccess = tostring(properties.publicNetworkAccess)
| order by name asc
Filter by area · KQL categories
Full read-only library

Azure Resource Graph queries

Loading queries