1# Azure Resource Graph Queries for Diagnostics
2 
3Azure Resource Graph (ARG) enables fast, cross-subscription resource querying using KQL via `az graph query`. Use it to check resource health, find degraded resources, and correlate incidents.
4 
5## How to Query
6 
7Use the `extension_cli_generate` MCP tool to generate `az graph query` commands:
8 
9```yaml
10mcp_azure_mcp_extension_cli_generate
11  intent: "query Azure Resource Graph to <describe what you want to diagnose>"
12  cli-type: "az"
13```
14 
15Or construct directly:
16 
17```bash
18az graph query -q "<KQL>" --query "data[].{name:name, type:type}" -o table
19```
20 
21> ⚠️ **Prerequisite:** `az extension add --name resource-graph`
22 
23## Key Tables
24 
25| Table | Contains |
26|-------|----------|
27| `Resources` | All ARM resources (name, type, location, properties, tags) |
28| `HealthResources` | Resource health availability status |
29| `ServiceHealthResources` | Azure service health events and incidents |
30| `ResourceContainers` | Subscriptions, resource groups, management groups |
31 
32## Diagnostics Query Patterns
33 
34**Check resource health status across resources:**
35 
36```kql
37HealthResources
38| where type =~ 'microsoft.resourcehealth/availabilitystatuses'
39| project name, availabilityState=properties.availabilityState, reasonType=properties.reasonType
40```
41 
42**Find resources in unhealthy or degraded state:**
43 
44```kql
45HealthResources
46| where type =~ 'microsoft.resourcehealth/availabilitystatuses'
47| where properties.availabilityState != 'Available'
48| project name, state=properties.availabilityState, reason=properties.reasonType, summary=properties.summary
49```
50 
51**Query active service health incidents:**
52 
53```kql
54ServiceHealthResources
55| where type =~ 'microsoft.resourcehealth/events'
56| where properties.Status == 'Active'
57| project name, title=properties.Title, impact=properties.Impact, status=properties.Status
58```
59 
60**Find resources by provisioning state (failed/stuck deployments):**
61 
62```kql
63Resources
64| where properties.provisioningState != 'Succeeded'
65| project name, type, resourceGroup, provisioningState=properties.provisioningState
66```
67 
68**Find App Services in stopped or error state:**
69 
70```kql
71Resources
72| where type =~ 'microsoft.web/sites'
73| where properties.state != 'Running'
74| project name, state=properties.state, resourceGroup, location
75```
76 
77**Find Container Apps with provisioning issues:**
78 
79```kql
80Resources
81| where type =~ 'microsoft.app/containerapps'
82| where properties.provisioningState != 'Succeeded'
83| project name, provisioningState=properties.provisioningState, resourceGroup
84```
85 
86## Tips
87 
88- Use `=~` for case-insensitive type matching (resource types are lowercase)
89- Navigate properties with `properties.fieldName`
90- Use `--first N` to limit result count
91- Use `--subscriptions` to scope to specific subscriptions
92- Combine ARG health data with Azure Monitor metrics for full picture
93- Check `HealthResources` before deep-diving into application logs
94