What is Azure Resource Graph?
Azure Resource Graph is a service in Azure that allows you to explore and analyze your resources at scale. It allows you to query the entire set of resources across one or many subscriptions, and provides the ability to understand and navigate the complexity of your environment. It helps you to discover and understand your resources, troubleshoot issues, and automate tasks. It provides a way to efficiently and performant query and explore resources and their properties across multiple subscriptions.
In this article, you can explore all the important Azure Resource Graph query examples in brief.
Azure Resource Graph enables full visibility into your environments by providing high performance and powerful query capability across all your resources. It also offers easy to use filtering and search tools. Using this Azure Resource Graph you can turn queries into charts and pin them to your portal dashboard to keep detailed insights in your active workflow.
With Azure Resource Graph KQL Query we can also configure and automate the KQL graph queries with Azure Logic Apps.
To run the following KQL queries use Azure Resource Graph Explorer in Azure Portal.
List the Services used by you or your comapny across all the Azure Subscriptions.
Get Total Number of Subscriptions in Tenant using the below Azure Resource Graph Query.
resourcecontainers | where type =~ "microsoft.resources/subscriptions" | extend Type = type | parse Type with ResourceType"/"Subscriptions | extend Subscriptions = "Subscriptions" | summarize count() by Subscriptions
Get Total Number of Resource Groups in your Tenant across all Subscriptions using the below Azure Resource Graph Query.
resourcecontainers | where type =~ "microsoft.resources/subscriptions/resourcegroups" | extend Type = type | parse Type with ResourceType"/"Subscriptions"/"ResourceGroups | extend ResourceGroups = "Resource Groups" | summarize count() by ResourceGroups
Find the count of Azure Services used across all Subscriptions using the below Azure Resource Graph Query.
resources | distinct type | summarize Service = "Resource Types", TotalCount=count()
Get the Count of Azure Resources used across all Subscriptions by Azure Service Type using the below Azure Resource Graph Query.
resources | where type != "" | extend Type = tostring(type) | parse Type with Microsoft"."ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType
Detailed View of Azure Services used in Azure Portal with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type != "" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Networking Services
Get the Detailed View of Azure Network Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.network" or type has "microsoft.cdn" or type has "Microsoft.Orbital" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Management Tools
Get the Detailed View of Azure Management Tools used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.insights" or type has "microsoft.recoveryservices" or type has "microsoft.advisor" or type has "microsoft.alertsmanagement" or type has "Microsoft.Automation" or type has "microsoft.hybridcompute" or type has "Microsoft.Kubernetes" or type has "Microsoft.AzureArcData" or type has "microsoft.visualstudio" or type has "microsoft.costmanagement" or type has "microsoft.resourcehealth" or type has "microsoft.operationalinsights" or type has "Microsoft.resourcegraph" or type has "microsoft.support" or type has "microsoft.policyinsights" or type has "microsoft.authorization" or type has "microsoft.policyinsights" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Migration Services
Get the Detailed View of Azure Migration Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.migrate" or type has "microsoft.datamigration" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Storage Services
Get the Detailed View of Azure Storage Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.storage" or type has "microsoft.storagesync" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Compute Infrastructure Services
Get the Detailed View of Azure Compute Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.compute" or type has "Microsoft.Batch" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Get the Count of Azure Virtual Machines by OS type
Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by OSType=tostring(properties.storageProfile.osDisk.osType)
Azure Compute Application Services
Get the Detailed View of Compute Application Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.web" or type has "microsoft.appconfiguration" or type has "microsoft.logic" or type has"microsoft.appconfiguration" or type has "microsoft.container" or type has "Microsoft.ContainerService" or type has "microsoft.hybridnetwork" or type has "Microsoft.NotificationHubs" or type has "Microsoft.ServiceFabric" or type has "Microsoft.AVS" or type has "Microsoft.DesktopVirtualization" or type has "Microsoft.AppPlatform" or type has "microsoft.desktopvirtualization" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Data Platform Services
Detailed View of Azure Data Platform Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.sql" or type has "microsoft.sqlvirtualmachine" or type has "microsoft.cache" or type has "microsoft.db" or type has "Microsoft.DocumentDb" or type has "Microsoft.DBforMySQL" or type has "Microsoft.DBforPostgreSQL" or type has "Microsoft.Synapse" or type has "Microsoft.DBforMariaDB" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Azure Analytics and Cognitive Services
Get the Detailed View of Azure Analytics & Cognitive Services used with Azure Service Type, Name and Resource Count using the below Azure Resource Graph Query.
resources | where type has "microsoft.eventgrid" or type has "microsoft.eventhub" or type has "microsoft.databricks" or type has "microsoft.datafactory" or type has "microsoft.devices" or type has "microsoft.iotcentral" or type has "microsoft.media" or type has "microsoft.search" or type has "microsoft.security" or type has "Microsoft.DataLakeStore" or type has "Microsoft.HDInsight" or type has "Microsoft.MachineLearningServices" or type has "Microsoft.StreamAnalytics" or type has "Microsoft.TimeSeriesInsights" or type has "microsoft.cognitiveservices" | extend Type = tostring(type) | parse Type with ResourceType"/"ServiceName | summarize Resource_Count=count() by ResourceType, ServiceName
Get the Count of Azure Resources by Type
Resources | where type != 'microsoft.compute/disks'
| where type != 'microsoft.compute/virtualmachines/extensions'
| where type !has 'microsoft.insights'
| where type != 'microsoft.operationsmanagement/solutions'
| where type != 'microsoft.compute/images'
| where type != 'microsoft.netapp/netappaccounts/capacitypools/volumes'
| extend type = case(
type =~ 'microsoft.automation/automationaccounts', 'Automation Accounts',
type =~ 'microsoft.operationalinsights/workspaces', 'Log Analytics Workspaces',
type =~ 'microsoft.netapp/netappaccounts', 'NetApp Accounts',
type == 'microsoft.web/serverfarms', "App Service Plans",
type == 'microsoft.web/sites', "App Services",
type =~ "microsoft.compute/virtualmachines", "Azure Compute",
type =~ "microsoft.logic/workflows", "LogicApps",
type =~ 'microsoft.keyvault/vaults', "Key Vaults",
type =~ 'microsoft.keyvault/vaults', "Hybrid Compute",
type =~ 'microsoft.storage/storageaccounts', "Storage Accounts",
type =~ 'microsoft.compute/availabilitysets', 'Availability Sets',
type =~ 'microsoft.insights/components','Application Insights',
type =~ 'microsoft.desktopvirtualization/applicationgroups', 'WVD Application Groups',
type =~ 'microsoft.desktopvirtualization/workspaces', 'WVD Workspaces',
type =~ 'microsoft.desktopvirtualization/hostpools', 'WVD Hostpools',
type =~ 'microsoft.recoveryservices/vaults', 'Backup Vaults',
type =~ 'microsoft.insights/webtests', 'URL Web Tests',
type =~ 'microsoft.web/connections', 'LogicApp Connectors',
type =~ 'microsoft.web/customapis','LogicApp API Connectors',
type =~ 'microsoft.managedidentity/userassignedidentities','Managed Identities',
type =~ 'microsoft.storagesync/storagesyncservices', 'Azure File Sync',
type =~ 'microsoft.hybridcompute/machines', 'ARC Machines',
type has 'microsoft.network', 'Network Resources',
strcat("Not Translated: ", type))
| summarize count() by type
| where type !has "Not Translated"
| order by ['count_'] desc
KQL Query to Get All Azure Resource types
To retrieve a list of all Azure resource types, you can use the following KQL (Kusto Query Language) query:
resources | distinct type
This query will return all unique resource types in your Azure environment.
KQL Query to Get Count of all the Azure Resource
To retrieve the count of all Azure resources, you can use the following KQL (Kusto Query Language) query:
resources | count
This query will return the total number of resources in your Azure environment.
You can also group the resources by their type and get the count for each type by using the following query:
resources | summarize count() by type
This query will return the count of resources for each resource type in your Azure environment.
Get All Azure Resource types with all the properties in it.
resources | where type != ""
Get Count of all the Azure Resource
resources | summarize count
or resources | where type != "" | summarize ResourceCount=count() by type
Azure Networking Services
resources | where type has "microsoft.network" or type has "microsoft.cdn"
Get all the distinct Azure Networking Services
resources | where type has "microsoft.network" or type has "microsoft.cdn" | distinct type
Azure Compute - Infrastructure Services
resources | where type has "microsoft.compute"
Get all the distinct Azure Compute - Infrastructure Services
resources | where type has "microsoft.compute" | distinct type
Azure Storage Services
resources | where type has "microsoft.storage" or type has "microsoft.storagesync"
resources | where type has "microsoft.storage" or type has "microsoft.storagesync" | distinct type
Azure Data Platform
resources | where type has "microsoft.sql" or type has "microsoft.sqlvirtualmachine" or type has "microsoft.cache" or type contains "microsoft.db"
resources | where type has "microsoft.sql" or type has "microsoft.sqlvirtualmachine" or type has "microsoft.cache" or type contains "microsoft.db" | distinct type
Azure Compute - Application Services
resources | where type has "microsoft.web" or type has "microsoft.appconfiguration" or type has "microsoft.logic" or type has"microsoft.appconfiguration" or type has "microsoft.container"
resources | where type has "microsoft.web" or type has "microsoft.appconfiguration" or type has "microsoft.logic" or type has"microsoft.appconfiguration" or type has "microsoft.container" | distinct type
Azure Analytics & Cognitive Services
resources | where type has "microsoft.eventgrid" or type has "microsoft.eventhub" or type has "microsoft.databricks" or type has "microsoft.datafactory" or type has "microsoft.devices" or type has "microsoft.iotcentral" or type has "microsoft.media" or type has "microsoft.search" or type has "microsoft.security"
resources | where type has "microsoft.eventgrid" or type has "microsoft.eventhub" or type has "microsoft.databricks" or type has "microsoft.datafactory" or type has "microsoft.devices" or type has "microsoft.iotcentral" or type has "microsoft.media" or type has "microsoft.search" or type has "microsoft.security" | distinct type
Azure Migration Services
resources | where type has "microsoft.migrate"
resources | where type has "microsoft.migrate" | distinct type
Azure Management Tools
resources | where type has "microsoft.insights" or type has "microsoft.recoveryservices"
resources | where type has "microsoft.insights" or type has "microsoft.recoveryservices" | distinct type
List all Azure public IP addresses:
Resources | where type contains 'publicIPAddresses' and isnotempty(properties.ipAddress)
Get Azure Management Groups Information:
ResourceContainers | where type =~ 'microsoft.management/managementgroups'
Get Azure Management Groups Count:
ResourceContainers | where type =~ 'microsoft.management/managementgroups' | count
Get the Count of Azure subscriptions per management group:
ResourceContainers
| where type =~ 'microsoft.management/managementgroups'
| project mgname = name
| join kind=leftouter (resourcecontainers | where type=~ 'microsoft.resources/subscriptions'
| extend mgParent = properties.managementGroupAncestorsChain | project id, mgname = tostring(mgParent[0].name)) on mgname
| summarize count() by mgname
Get Azure Subscriptions along with Subscription Ids:
ResourceContainers
| where type =~ 'microsoft.resources/subscriptions'
| project SubscritionName=name, subscriptionId
resourcecontainers | where type =~ "microsoft.resources/subscriptions" | take 120
Find Count of Subscriptions which has a same name:
resourcecontainers | where type =~ "microsoft.resources/subscriptions" | summarize count() by name
Count virtual machines by OS type:
Resources
| where type =~ 'Microsoft.Compute/virtualMachines'
| summarize count() by tostring(properties.storageProfile.osDisk.osType)
Get Count of Resource Groups Across Subscriptions:
resourcecontainers
| where type =~ "microsoft.resources/subscriptions/resourcegroups"
| extend Type = type
| parse Type with ResourceType"/"Subscriptions"/"ResourceGroups
| extend ResourceGroups = "Resource Groups"
| summarize count() by ResourceGroups
Find Azure Storage Account Creation Date, Time, Blob last Enabled Date & Time, Files last Enabled Date & Time
resources
| where type =="microsoft.storage/storageaccounts"
| extend privateendpointconnect=properties.privateEndpointConnections[0].properties.privateEndpoint.id
| extend s=split(privateendpointconnect,"/")
| join kind=inner ( ResourceContainers | where type =~ 'microsoft.resources/subscriptions'
| project subscriptionId, Subscription=name) on subscriptionId
| project StorageAccountName=name, CreationTime=['properties'].creationTime,
BloblastEnabledTime=properties.encryption.services.blob.lastEnabledTime,
FilelastEnabledTime=properties.encryption.services.file.lastEnabledTime,
PrivateEndpointConnection=tostring(s[-1]), Subscription,ResourceGroup=resourceGroup,
Location=location,Kind=['kind'], ApplicatioName=['tags'].ApplicationName,BusinessArea=['tags'].BusinessArea,OwnerName=['tags'].OwnerName,OwnerEmail=['tags'].OwnerEmail