What is Azure Resource Graph?
Azure Resource Graph is an Azure service designed to extend Azure Resource Management by providing efficient and performant resource exploration. It can query at scale across a given set of subscriptions so you can effectively govern your environment.
Queries provide complex filtering, grouping, and sorting by resource properties, iterative exploration of resources based on governance requirements, assessment of the effect of applying policies in a large cloud environment, and queries over changes made to resource properties.
Azure Resource Graph is also the foundation for several portal features: per Microsoft, it powers the Azure portal search bar, the ‘All resources’ browse experience, and the visual diff in Azure Policy change history. Azure Resource Manager itself supports queries only over basic resource fields such as name, ID, type, resource group, subscription, and location. With Resource Graph you access the properties returned by resource providers without making individual calls to each provider.
Core Features
- KQL-based queries across subscriptions, with filtering, grouping, and sorting by resource properties
- Access to provider properties without individual calls per resource provider
- View of resource configuration changes from the last 14 days
- Azure Resource Graph Explorer in the portal with results pinned as dynamic charts
- Support for Azure CLI, Azure PowerShell, and REST API with identical query structure
- Power BI connector running at the tenant level, with scope adjustable to subscription or management group
- Alerting through Azure Resource Graph queries and Log Analytics integration (in public preview per Microsoft)
- Support for Azure Lighthouse for service providers
Typical Use Cases
Resource inventory
Platform teams build overviews of all resources in an environment, filtered by type, tag, region, or any provider property.
Governance and policy preparation
Before rolling out an Azure Policy, you can estimate how many and which resources would be affected. The built-in compliance view rounds out the picture.
Change tracking
The last 14 days of change history let you trace which properties of a resource changed and when — useful when investigating unexpected configuration changes.
Dashboards and reporting
Results can be pinned in the portal as dynamic charts. For recurring reports, the Power BI connector is available and can optionally return more than 1,000 records.
Benefits
- Free to use, with throttling only to maintain service quality
- One query path for the whole resource estate instead of individual calls per resource provider
- A familiar language: KQL, as in Azure Data Explorer and Azure Monitor
- Usable directly in the portal and automatable through CLI, PowerShell, and REST API
- Transparent throttling through response headers showing the remaining quota
- Azure Lighthouse support for managing delegated customer environments
Integration with innFactory
As a Microsoft Solutions Partner, innFactory helps you build governance analytics with Azure Resource Graph: we develop KQL queries for your resource inventory, build dashboards and reports, and connect the results to your policy and compliance processes.
We also advise on the structure of your Azure landing zone, tagging concepts, and automation of recurring analyses. Contact us for a no-obligation consultation.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What does Azure Resource Graph cost?
Microsoft describes Resource Graph as a free service: 'As a free service, queries to Resource Graph are throttled to provide the best experience and response time for all customers.' Throttling happens at the user level; the remaining quota and time until reset are returned in response headers.
Which query language is used?
The Azure Resource Graph query language is based on the Kusto Query Language (KQL) also used by Azure Data Explorer. That enables complex filtering, grouping, and sorting by resource properties.
How current is the data?
When an Azure resource is updated, Azure Resource Manager notifies Azure Resource Graph, which then updates its database. A regular full scan also runs so data stays current if notifications are missed or a resource is updated outside Resource Manager. Microsoft explicitly notes that the data isn't strongly consistent and is indexed with a short latency.
How far back does the change history go?
You can view the last 14 days of resource configuration changes and see which properties changed and when.
Which permissions are required?
Under Azure RBAC you need at least read access to the resources you want to query. No results are returned without read permission. If none of the subscriptions in the provided list are ones the user has rights to, the response is HTTP 403.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
