Skip to main content
Cloud / Azure / Products / Azure Resource Graph - Resource Queries with KQL

Azure Resource Graph - Resource Queries with KQL

Azure Resource Graph: KQL-based queries across all Azure resources, the engine behind portal search, with 14 days of change history and free to use.

management-and-governance
Pricing Model Free service; queries are throttled to maintain service quality
Availability Available through the Azure portal (Resource Graph Explorer), Azure CLI, Azure PowerShell, and REST API
Data Sovereignty Metadata about your Azure resources; see official documentation for details
Reliability per provider / see official documentation SLA

What is Azure Resource Graph?

Azure Resource Graph is an Azure service designed to extend Azure Resource Management by providing efficient and performant resource exploration. It can query at scale across a given set of subscriptions so you can effectively govern your environment.

Queries provide complex filtering, grouping, and sorting by resource properties, iterative exploration of resources based on governance requirements, assessment of the effect of applying policies in a large cloud environment, and queries over changes made to resource properties.

Azure Resource Graph is also the foundation for several portal features: per Microsoft, it powers the Azure portal search bar, the ‘All resources’ browse experience, and the visual diff in Azure Policy change history. Azure Resource Manager itself supports queries only over basic resource fields such as name, ID, type, resource group, subscription, and location. With Resource Graph you access the properties returned by resource providers without making individual calls to each provider.

Core Features

  • KQL-based queries across subscriptions, with filtering, grouping, and sorting by resource properties
  • Access to provider properties without individual calls per resource provider
  • View of resource configuration changes from the last 14 days
  • Azure Resource Graph Explorer in the portal with results pinned as dynamic charts
  • Support for Azure CLI, Azure PowerShell, and REST API with identical query structure
  • Power BI connector running at the tenant level, with scope adjustable to subscription or management group
  • Alerting through Azure Resource Graph queries and Log Analytics integration (in public preview per Microsoft)
  • Support for Azure Lighthouse for service providers

Typical Use Cases

Resource inventory
Platform teams build overviews of all resources in an environment, filtered by type, tag, region, or any provider property.

Governance and policy preparation
Before rolling out an Azure Policy, you can estimate how many and which resources would be affected. The built-in compliance view rounds out the picture.

Change tracking
The last 14 days of change history let you trace which properties of a resource changed and when — useful when investigating unexpected configuration changes.

Dashboards and reporting
Results can be pinned in the portal as dynamic charts. For recurring reports, the Power BI connector is available and can optionally return more than 1,000 records.

Benefits

  • Free to use, with throttling only to maintain service quality
  • One query path for the whole resource estate instead of individual calls per resource provider
  • A familiar language: KQL, as in Azure Data Explorer and Azure Monitor
  • Usable directly in the portal and automatable through CLI, PowerShell, and REST API
  • Transparent throttling through response headers showing the remaining quota
  • Azure Lighthouse support for managing delegated customer environments

Integration with innFactory

As a Microsoft Solutions Partner, innFactory helps you build governance analytics with Azure Resource Graph: we develop KQL queries for your resource inventory, build dashboards and reports, and connect the results to your policy and compliance processes.

We also advise on the structure of your Azure landing zone, tagging concepts, and automation of recurring analyses. Contact us for a no-obligation consultation.

Typical Use Cases

Resource inventory across subscriptions and tenants
Governance analysis and preparation of policy rollouts
Tracing configuration changes from the last 14 days
Azure portal dashboards with pinned query results
Reporting through the Power BI connector

Technical Specifications

0th Query language based on Kusto Query Language (KQL) from Azure Data Explorer
1st Complex filtering, grouping, and sorting by resource properties
2nd Access to resource provider properties without individual calls per provider
3rd View the last 14 days of resource configuration changes including which properties changed
4th Powers the Azure portal search bar, the 'All resources' browse experience, and Azure Policy change history
5th Kept current by Azure Resource Manager notifications plus a regular full scan
6th Data isn't strongly consistent; it is indexed with a short latency
7th Requires at least read access (Azure RBAC) to the queried resources; HTTP 403 without permissions
8th Throttled at the user level; response headers 'x-ms-user-quota-remaining' and 'x-ms-user-quota-resets-after'
9th Supports Azure Lighthouse; Power BI connector with an optional setting to return all records beyond 1,000 rows

Frequently Asked Questions

What does Azure Resource Graph cost?

Microsoft describes Resource Graph as a free service: 'As a free service, queries to Resource Graph are throttled to provide the best experience and response time for all customers.' Throttling happens at the user level; the remaining quota and time until reset are returned in response headers.

Which query language is used?

The Azure Resource Graph query language is based on the Kusto Query Language (KQL) also used by Azure Data Explorer. That enables complex filtering, grouping, and sorting by resource properties.

How current is the data?

When an Azure resource is updated, Azure Resource Manager notifies Azure Resource Graph, which then updates its database. A regular full scan also runs so data stays current if notifications are missed or a resource is updated outside Resource Manager. Microsoft explicitly notes that the data isn't strongly consistent and is indexed with a short latency.

How far back does the change history go?

You can view the last 14 days of resource configuration changes and see which properties changed and when.

Which permissions are required?

Under Azure RBAC you need at least read access to the resources you want to query. No results are returned without read permission. If none of the subscriptions in the provided list are ones the user has rights to, the response is HTTP 403.

Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.

Microsoft Solutions Partner

innFactory is a Microsoft Solutions Partner. We provide expert consulting, implementation, and managed services for Azure.

Microsoft Solutions Partner Microsoft Data & AI

Ready to start with Azure Resource Graph - Resource Queries with KQL?

Our certified Azure experts help you with architecture, integration, and optimization.

Schedule Consultation