1# Azure Resource Graph Queries for Compliance Auditing
2 
3Azure Resource Graph (ARG) enables fast, cross-subscription resource querying using KQL via `az graph query`. Use it for compliance scanning, tag audits, and configuration validation.
4 
5## How to Query
6 
7Use the `extension_cli_generate` MCP tool to generate `az graph query` commands:
8 
9```yaml
10mcp_azure_mcp_extension_cli_generate
11  intent: "query Azure Resource Graph to <describe what you want to audit>"
12  cli-type: "az"
13```
14 
15Or construct directly:
16 
17```bash
18az graph query -q "<KQL>" --query "data[].{name:name, type:type}" -o table
19```
20 
21> ⚠️ **Prerequisite:** `az extension add --name resource-graph`
22 
23## Key Tables
24 
25| Table | Contains |
26|-------|----------|
27| `Resources` | All ARM resources (name, type, location, properties, tags) |
28| `ResourceContainers` | Subscriptions, resource groups, management groups |
29| `AuthorizationResources` | Role assignments and role definitions |
30| `AdvisorResources` | Azure Advisor recommendations |
31 
32## Compliance Query Patterns
33 
34**Find resources missing a required tag:**
35 
36```kql
37Resources
38| where isnull(tags['Environment']) or isnull(tags['CostCenter'])
39| project name, type, resourceGroup, tags
40```
41 
42**Tag coverage analysis:**
43 
44```kql
45Resources
46| extend hasEnvTag = isnotnull(tags['Environment'])
47| summarize total=count(), tagged=countif(hasEnvTag) by type
48| extend coverage=round(100.0 * tagged / total, 1)
49| order by coverage asc
50```
51 
52**Find storage accounts without HTTPS enforcement:**
53 
54```kql
55Resources
56| where type =~ 'microsoft.storage/storageaccounts'
57| where properties.supportsHttpsTrafficOnly == false
58| project name, resourceGroup, location
59```
60 
61**Find resources with public network access enabled:**
62 
63```kql
64Resources
65| where properties.publicNetworkAccess =~ 'Enabled'
66| project name, type, resourceGroup, location
67```
68 
69**Query role assignments across subscriptions:**
70 
71```kql
72AuthorizationResources
73| where type == 'microsoft.authorization/roleassignments'
74| extend principalType = tostring(properties.principalType)
75| summarize count() by principalType
76```
77 
78**Find resource groups without locks:**
79 
80```kql
81ResourceContainers
82| where type == 'microsoft.resources/subscriptions/resourcegroups'
83| project rgName=name, rgId=id
84| join kind=leftanti (
85    Resources
86    | where type == 'microsoft.authorization/locks'
87    | project rgId=tostring(properties.resourceId)
88) on rgId
89```
90 
91## Tips
92 
93- Use `=~` for case-insensitive type matching (resource types are lowercase)
94- Navigate properties with `properties.fieldName`
95- Use `--first N` to limit result count
96- Use `--subscriptions` to scope to specific subscriptions
97- Combine with `AdvisorResources` for security recommendations
98