1# Azure Resource Graph Query Patterns
2 
3Azure Resource Graph (ARG) queries use a KQL subset against indexed Azure resource metadata. Results are near real-time across all subscriptions.
4 
5## Command Format
6 
7```bash
8az graph query -q "<KQL>" --query "data[].{col1:field1, col2:field2}" -o table
9```
10 
11| Flag | Purpose |
12|------|---------|
13| `-q` | KQL query string |
14| `--query` | JMESPath to shape output columns |
15| `--first N` | Limit to N results |
16| `--subscriptions` | Scope to specific subscription IDs |
17| `-o table` | Table output (also: json, tsv) |
18 
19## Key Tables
20 
21| Table | Contents |
22|-------|----------|
23| `Resources` | All ARM resources — name, type, location, properties, tags, sku |
24| `ResourceContainers` | Subscriptions, resource groups, management groups |
25| `HealthResources` | Resource health availability status |
26| `ServiceHealthResources` | Azure service health events/incidents |
27| `AuthorizationResources` | Role assignments and definitions |
28| `AdvisorResources` | Azure Advisor recommendations |
29 
30## KQL Essentials
31 
32- `=~` case-insensitive equals (use for `type` field — types are lowercase)
33- `properties.fieldName` navigates the properties JSON bag
34- `mv-expand` flattens arrays (subnets, IP configs)
35- `isempty()` / `isnotnull()` checks for null/empty fields
36- `tostring()` converts dynamic fields for display
37 
38---
39 
40## Resource Inventory Patterns
41 
42**Count all resources by type:**
43```kql
44Resources | summarize count() by type | order by count_ desc
45```
46 
47**Inventory by type and location:**
48```kql
49Resources | summarize count() by type, location | order by type asc
50```
51 
52**Cross-subscription inventory with subscription names:**
53```kql
54Resources
55| join kind=leftouter (
56    ResourceContainers
57    | where type == 'microsoft.resources/subscriptions'
58    | project subscriptionId, subscriptionName=name
59) on subscriptionId
60| summarize count() by subscriptionName, type
61| order by subscriptionName asc, count_ desc
62```
63 
64**All resources in a resource group:**
65```kql
66Resources
67| where resourceGroup =~ '<rg-name>'
68| project name, type, location, sku.name, kind
69```
70 
71## Orphaned Resource Patterns
72 
73**Unattached managed disks:**
74```kql
75Resources
76| where type =~ 'microsoft.compute/disks'
77| where isempty(managedBy)
78| project name, resourceGroup, location, diskSizeGb=properties.diskSizeGB, sku=sku.name
79```
80 
81**Unused public IP addresses:**
82```kql
83Resources
84| where type =~ 'microsoft.network/publicipaddresses'
85| where isempty(properties.ipConfiguration)
86| project name, resourceGroup, location, sku=sku.name
87```
88 
89**Orphaned network interfaces:**
90```kql
91Resources
92| where type =~ 'microsoft.network/networkinterfaces'
93| where isempty(properties.virtualMachine)
94| project name, resourceGroup, location
95```
96 
97**Idle load balancers (no backends):**
98```kql
99Resources
100| where type =~ 'microsoft.network/loadbalancers'
101| where array_length(properties.backendAddressPools) == 0
102| project name, resourceGroup, location
103```
104 
105## Tag & Compliance Patterns
106 
107**Resources missing a required tag:**
108```kql
109Resources
110| where isnull(tags['Environment']) or isnull(tags['CostCenter'])
111| project name, type, resourceGroup, tags
112```
113 
114**Tag coverage analysis by type:**
115```kql
116Resources
117| extend hasTag = isnotnull(tags['Environment'])
118| summarize total=count(), tagged=countif(hasTag) by type
119| extend coverage=round(100.0 * tagged / total, 1)
120| order by coverage asc
121```
122 
123**Resources with public network access:**
124```kql
125Resources
126| where properties.publicNetworkAccess =~ 'Enabled'
127| project name, type, resourceGroup, location
128```
129 
130## Health & Diagnostics Patterns
131 
132**Resource health status:**
133```kql
134HealthResources
135| where type =~ 'microsoft.resourcehealth/availabilitystatuses'
136| where properties.availabilityState != 'Available'
137| project name, state=properties.availabilityState, reason=properties.reasonType
138```
139 
140**Active service health incidents:**
141```kql
142ServiceHealthResources
143| where type =~ 'microsoft.resourcehealth/events'
144| where properties.Status == 'Active'
145| project name, title=properties.Title, status=properties.Status
146```
147 
148**Failed provisioning states:**
149```kql
150Resources
151| where properties.provisioningState != 'Succeeded'
152| project name, type, resourceGroup, state=properties.provisioningState
153```
154 
155## Service-Specific Patterns
156 
157**App Services and their plans:**
158```kql
159Resources
160| where type =~ 'microsoft.web/sites'
161| project name, kind, location, plan=properties.serverFarmId, state=properties.state, resourceGroup
162```
163 
164**Container Apps:**
165```kql
166Resources
167| where type =~ 'microsoft.app/containerapps'
168| project name, location, provisioningState=properties.provisioningState, resourceGroup
169```
170 
171**VNet and subnet discovery:**
172```kql
173Resources
174| where type =~ 'microsoft.network/virtualnetworks'
175| mv-expand subnet=properties.subnets
176| project vnetName=name, subnetName=subnet.name, prefix=subnet.properties.addressPrefix
177```
178 
179**Advisor cost recommendations:**
180```kql
181AdvisorResources
182| where properties.category == 'Cost'
183| project name, impact=properties.impact, solution=properties.shortDescription.solution
184```
185