Azure Resource Graph Query Builder

MonitoringAzure

Build Resource Graph Explorer query configs with KQL queries for orphaned resources, compliance reports, and inventory.

Azure Resource Graph Configuration

Build Resource Graph Explorer query configs with KQL queries for orphaned resources, compliance reports, and cross-subscription inventory.

Required Fields

queryNamequeriesqueries[0].namequeries[0].kql

{
  "queryName": "Orphaned Resources Report",
  "description": "Finds unattached disks, unused public IPs, and orphaned NICs across all subscriptions.",
  "subscriptions": ["a1b2c3d4-e5f6-7890-abcd-ef1234567890", "b2c3d4e5-f6a7-8901-bcde-f23456789012"],
  "managementGroups": [],
  "queries": [
    {
      "name": "UnattachedManagedDisks",
      "table": "resources",
      "kql": "resources\n| where type == 'microsoft.compute/disks'\n| where managedBy == ''\n| where properties.diskState == 'Unattached'\n| project name, resourceGroup, subscriptionId, location, sku.name, properties.diskSizeGB, tags\n| order by tolong(properties_diskSizeGB) desc",
      "resultFormat": "table"
    },
    {
      "name": "UnusedPublicIPs",
      "table": "resources",
      "kql": "resources\n| where type == 'microsoft.network/publicipaddresses'\n| where properties.ipConfiguration == ''\n| where properties.natGateway == ''\n| project name, resourceGroup, subscriptionId, location, properties.ipAddress, sku.name, tags\n| order by name asc",
      "resultFormat": "table"
    },
    {
      "name": "OrphanedNICs",
      "table": "resources",
      "kql": "resources\n| where type == 'microsoft.network/networkinterfaces'\n| where isnull(properties.virtualMachine)\n| where isnull(properties.privateEndpoint)\n| project name, resourceGroup, subscriptionId, location, properties.ipConfigurations[0].properties.privateIPAddress\n| order by name asc",
      "resultFormat": "table"
    },
    {
      "name": "ResourceCountByType",
      "table": "resources",
      "kql": "resources\n| summarize count() by type\n| order by count_ desc\n| take 20",
      "resultFormat": "chart"
    },
    {
      "name": "VMsWithoutTags",
      "table": "resources",
      "kql": "resources\n| where type == 'microsoft.compute/virtualmachines'\n| where isnull(tags) or tags == '{}'\n| project name, resourceGroup, subscriptionId, location, properties.hardwareProfile.vmSize",
      "resultFormat": "table"
    }
  ],
  "scheduledExport": {
    "enabled": true,
    "frequency": "Weekly",
    "dayOfWeek": "Monday",
    "timeOfDay": "08:00",
    "format": "CSV",
    "destination": {
      "type": "StorageAccount",
      "storageAccountId": "/subscriptions/a1b2c3d4/resourceGroups/rg-reports/providers/Microsoft.Storage/storageAccounts/stcontosoreports",
      "containerName": "resource-graph-reports"
    }
  }
}

Generated Output

Output will appear here...

How This Tool Works

The tool validates that queryName, queries, and the first query's name/kql resolve, then assembles the combined query set plus optional scheduled export configuration into the shape Resource Graph Explorer and its export feature expect; it doesn't execute the KQL or validate it against Resource Graph's actual supported syntax subset, that's only confirmed when the query is run against a live Resource Graph endpoint.

Overview

Build Azure Resource Graph KQL queries operating over the resources table (a cached, cross-subscription snapshot of resource metadata, refreshed periodically rather than a live query against every resource), well suited for exactly the kind of orphaned-resource and cross-subscription inventory reports in the example (unattached disks, unused public IPs, orphaned NICs). Resource Graph's KQL is a meaningfully restricted dialect of the same language used in Log Analytics/ADX, several operators and functions available in those contexts simply aren't supported against the resources table, and the query results reflect Resource Graph's cache freshness (typically within minutes, not instantaneous), both worth knowing before assuming a query pattern that works in Log Analytics will translate directly.

How Engineers Use This

•Querying for unattached managed disks (managedBy == '' and diskState == 'Unattached') across every subscription in the tenant in one query, rather than needing to check each subscription individually through the portal.
•Finding unused public IP addresses (no ipConfiguration and no natGateway association) to identify a real, ongoing cost being paid for IP addresses that aren't actually serving any traffic.
•Scheduling a weekly export of these orphaned-resource and inventory queries to a storage account, so a FinOps or platform team gets a regular, hands-off report rather than needing to remember to run the queries manually.
•Using a summarize-based query (ResourceCountByType) with resultFormat chart for a quick visual breakdown of resource type distribution, useful for a portfolio-level inventory review without needing to build a separate dashboard.

Tips & Gotchas

TIP

Don't assume every Log Analytics or ADX KQL pattern works unchanged against Resource Graph's resources table, its supported KQL subset is more restricted, test queries directly against Resource Graph rather than assuming portability from a different KQL context.

TIP

Remember Resource Graph reflects a periodically-refreshed cache, not live resource state, fine for governance and inventory reporting, not appropriate as the basis for a decision requiring guaranteed real-time accuracy.

TIP

Scheduled exports turn one-off manual queries into an ongoing, hands-off reporting habit, worth setting up for any query (like the orphaned-resource ones in this example) that's genuinely valuable to check regularly rather than only when someone remembers to run it.

Questions & Answers

Does a Resource Graph query reflect the absolute current state of resources, or a cached snapshot?

A cached snapshot, refreshed periodically (typically within minutes of an actual resource change, not instantaneous), Resource Graph trades a small amount of freshness for the ability to query across potentially thousands of resources and many subscriptions quickly, without the latency of querying each resource provider live. For most inventory and governance use cases this lag is inconsequential, but don't rely on Resource Graph results for a decision requiring absolutely real-time resource state.

Can I use the full KQL feature set (like the same operators available in Log Analytics) against the resources table?

No, Resource Graph supports a meaningfully restricted subset of KQL compared to Log Analytics or Azure Data Explorer, certain operators, join types, and functions available in those richer KQL contexts aren't supported when querying the resources table. If a query pattern that works in Log Analytics fails against Resource Graph, check the specific supported KQL subset rather than assuming it's a syntax typo.

Does scheduledExport run the query against live data at export time, or export a previously-cached result?

It runs the query fresh at the scheduled time (against Resource Graph's then-current cached snapshot, which is itself continuously refreshed), so a weekly Monday 8am export reflects resource state as of Resource Graph's cache at that time, not a stale result from whenever the export was originally configured.

Related Learning Guides

Cost Management Guide24 min read
Azure Monitor & Application Insights26 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.