Azure Resource Graph: Querying Your Infrastructure

Azure Resource Graph is an exploration service that allows you to query your Azure resources across multiple subscriptions using Kusto Query Language (KQL). It enables rapid inventory audits and governance reporting by providing a highly performant, read-only view of your resource properties without needing to poll individual APIs.

What is Azure Resource Graph and Why Does It Matter?

If you've ever tried to find every single public IP address across ten different Azure subscriptions, you know it can be a total nightmare. That's where Azure Resource Graph comes in. Think of it as a highly optimized, read-only index of every resource in your environment. Instead of waiting for the Azure Portal to load a list of resources one by one, Resource Graph allows you to query your entire estate in seconds.

For those of you prepping for the AZ-900 exam, you need to understand that this tool is central to Azure governance. It doesn't just tell you what you have; it helps you identify resources that aren't following your organization's naming conventions or those that are missing critical tags. In a real-world enterprise environment with thousands of resources, this level of visibility is the difference between a secure cloud and a chaotic one.

How Do You Use KQL to Find Resources?

To get anything out of Resource Graph, you'll need to use Kusto Query Language (KQL). Now, don't let the name intimidate you. If you've ever written a basic SQL query, you're already 70% of the way there. KQL uses a pipe-based syntax that allows you to filter and project data in a logical flow. For example, if you want to find all your Virtual Machines, you'd start with the 'resources' table and pipe it into a 'where' clause filtering by type.

I always tell my students to practice writing these queries in the Azure Resource Graph Explorer. Try querying for resources with a specific tag or those located in a particular region. Mastering KQL isn't just about passing the AZ-900; it's a superpower in the workplace. Being the person who can pull a full inventory report in thirty seconds makes you an immediate asset to any cloud operations team.

Can You Perform Audits Across Multiple Subscriptions?

One of the biggest pain points in Azure management is 'subscription sprawl.' When your company has dozens of subscriptions for different departments, keeping track of costs and compliance becomes a full-time job. Azure Resource Graph solves this by allowing cross-subscription queries. You can pull a single report that lists every storage account across your entire tenant, regardless of which subscription it lives in.

This is critical for performing inventory audits. Imagine your security lead asks for a list of all disks that aren't encrypted. Without Resource Graph, you'd be clicking through subscriptions for hours. With a simple KQL query, you can identify every non-compliant disk across the entire organization in one go. We emphasize these governance scenarios because they are exactly the kind of practical applications Microsoft tests for in their fundamentals exams.

What is the Difference Between Resource Graph and Azure Monitor?

This is a classic point of confusion for AZ-900 candidates. Here is the simple breakdown: Azure Resource Graph is about *state* and *inventory*, while Azure Monitor is about *performance* and *health*. If you need to know 'How many VMs do I have in East US?' you use Resource Graph. If you need to know 'Why is my VM CPU spiking at 2 AM?' you use Azure Monitor.

Resource Graph queries the properties of the resources (the metadata), whereas Azure Monitor collects telemetry, logs, and metrics. Think of Resource Graph as the 'Phone Book' of your infrastructure—it tells you who is there and where they are. Azure Monitor is the 'Heart Rate Monitor'—it tells you if they are healthy and how they are performing. Understanding this distinction is key to choosing the right tool for the job and scoring high on the management domain of your exam.

How Do You Export Data for Governance Reporting?

Knowing the data is one thing; presenting it to your boss is another. Azure Resource Graph allows you to export your query results directly to a CSV file. This is a lifesaver for governance reporting. You can run a query to find all resources missing a 'CostCenter' tag and hand that CSV to the finance team to track down the owners.

For those looking to automate this, you can also access Resource Graph via the Azure CLI or PowerShell. This allows you to integrate your inventory audits into a larger CI/CD pipeline or a scheduled report. When you're building your governance strategy, remember that data is only useful if it's actionable. By exporting these lists, you move from simply 'knowing' you have a problem to 'fixing' it across your entire cloud footprint.

How Does This Fit Into Your AZ-900 Study Plan?

Azure Resource Graph falls under the 'Azure Management and Governance' domain of the AZ-900 exam. While you might not need to be a KQL expert to pass, you must understand how it fits into the broader ecosystem of Azure Policy and Role-Based Access Control (RBAC). It's the tool that provides the visibility needed to enforce those policies effectively.

To make sure you're truly ready, we recommend diving into our practice exams. At Cert Sensei, we provide 1,000 expert-curated Microsoft Azure Fundamentals (AZ-900) practice questions. We don't just give you the right answer; we provide detailed expert reasoning for every single question and domain-level analytics. This means if you're struggling with the governance section, you'll know exactly where to focus your study hours so you can walk into that testing center with total confidence.

❓ Frequently Asked Questions