1# Azure Resource Graph Queries for Cost Optimization
2 
3Azure Resource Graph (ARG) enables fast, cross-subscription resource querying using KQL via `az graph query`. Use it to find orphaned resources, unused infrastructure, and optimization targets.
4 
5## How to Query
6 
7Use the `extension_cli_generate` MCP tool to generate `az graph query` commands:
8 
9```yaml
10azure__extension_cli_generate
11  intent: "query Azure Resource Graph to <describe what you want to find>"
12  cli-type: "az"
13```
14 
15Or construct directly:
16 
17```bash
18az graph query -q "<KQL>" --query "data[].{name:name, type:type}" -o table
19```
20 
21> ⚠️ **Prerequisite:** `az extension add --name resource-graph`
22 
23## Key Tables
24 
25| Table | Contains |
26|-------|----------|
27| `Resources` | All ARM resources (name, type, location, properties, tags) |
28| `ResourceContainers` | Subscriptions, resource groups, management groups |
29| `AdvisorResources` | Cost and performance recommendations |
30 
31## Cost Optimization Query Patterns
32 
33**Find orphaned (unattached) managed disks:**
34 
35```kql
36Resources
37| where type =~ 'microsoft.compute/disks'
38| where isempty(managedBy)
39| project name, resourceGroup, location, diskSizeGb=properties.diskSizeGB, sku=sku.name
40```
41 
42**Find unattached public IP addresses:**
43 
44```kql
45Resources
46| where type =~ 'microsoft.network/publicipaddresses'
47| where isempty(properties.ipConfiguration)
48| project name, resourceGroup, location, sku=sku.name
49```
50 
51**Find orphaned network interfaces:**
52 
53```kql
54Resources
55| where type =~ 'microsoft.network/networkinterfaces'
56| where isempty(properties.virtualMachine)
57| project name, resourceGroup, location
58```
59 
60**Resource count by SKU/tier (spot oversized resources):**
61 
62```kql
63Resources
64| where isnotempty(sku.name)
65| summarize count() by type, tostring(sku.name)
66| order by count_ desc
67```
68 
69**Tag coverage for cost allocation:**
70 
71```kql
72Resources
73| extend hasCostCenter = isnotnull(tags['CostCenter'])
74| summarize total=count(), tagged=countif(hasCostCenter) by type
75| extend coverage=round(100.0 * tagged / total, 1)
76| order by total desc
77```
78 
79**Find idle load balancers (no backend pools):**
80 
81```kql
82Resources
83| where type =~ 'microsoft.network/loadbalancers'
84| where array_length(properties.backendAddressPools) == 0
85| project name, resourceGroup, location, sku=sku.name
86```
87 
88**Get Advisor cost recommendations:**
89 
90```kql
91AdvisorResources
92| where properties.category == 'Cost'
93| project name, impact=properties.impact, description=properties.shortDescription.solution
94```
95 
96## Tips
97 
98- Use `=~` for case-insensitive type matching (resource types are lowercase)
99- Navigate properties with `properties.fieldName`
100- Use `--first N` to limit result count
101- Use `--subscriptions` to scope to specific subscriptions
102- Cross-reference orphaned resources with cost data from Cost Management API
103