{"id":20291237,"url":"https://github.com/arsenvlad/azure-resource-graph-query-examples","last_synced_at":"2026-03-07T12:01:27.279Z","repository":{"id":252448737,"uuid":"840475078","full_name":"arsenvlad/azure-resource-graph-query-examples","owner":"arsenvlad","description":"Azure Resource Graph query examples","archived":false,"fork":false,"pushed_at":"2024-08-15T19:57:37.000Z","size":5,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-04T04:44:22.969Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/arsenvlad.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-09T19:46:01.000Z","updated_at":"2024-08-15T19:57:40.000Z","dependencies_parsed_at":"2024-11-14T15:11:16.555Z","dependency_job_id":"ca316377-60ce-4e51-80ad-f378d883283b","html_url":"https://github.com/arsenvlad/azure-resource-graph-query-examples","commit_stats":null,"previous_names":["arsenvlad/azure-resource-graph-query-examples"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/arsenvlad/azure-resource-graph-query-examples","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arsenvlad%2Fazure-resource-graph-query-examples","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arsenvlad%2Fazure-resource-graph-query-examples/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arsenvlad%2Fazure-resource-graph-query-examples/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arsenvlad%2Fazure-resource-graph-query-examples/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/arsenvlad","download_url":"https://codeload.github.com/arsenvlad/azure-resource-graph-query-examples/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arsenvlad%2Fazure-resource-graph-query-examples/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30212485,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-07T09:02:10.694Z","status":"ssl_error","status_checked_at":"2026-03-07T09:02:08.429Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-14T15:11:14.705Z","updated_at":"2026-03-07T12:01:27.241Z","avatar_url":"https://github.com/arsenvlad.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure Resource Graph query examples\n\nLearn more about [Azure Resource Graph](https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview)\n\n## Private Endpoints per VNet\n\nSample query that returns number of private endpoints per VNet.\n\n ```kql\nresources\n| where type == \"microsoft.network/privateendpoints\"\n| extend subnetId = tostring(properties.subnet.id)\n| mv-expand privateLinkServiceConnections = properties.privateLinkServiceConnections\n| extend privateLinkServiceId = tostring(privateLinkServiceConnections.properties.privateLinkServiceId)\n| extend privateLinkServiceConnectionStatus = tostring(privateLinkServiceConnections.properties.privateLinkServiceConnectionState.status)\n| join kind=inner (resources | where type == \"microsoft.network/virtualnetworks\" | mv-expand subnets = properties.subnets | extend vnetSubnetId = tostring(subnets.id) | project vnetId = id, vnetSubnetId) on $left.subnetId == $right.vnetSubnetId\n| project subscriptionId, id, name, location, vnetId, subnetId, privateLinkServiceId, privateLinkServiceConnectionStatus\n| summarize dcount(id) by subscriptionId, vnetId, location\n```\n\n## Private Endpoint connections per Private Link Service\n\nSample query that returns number of private endpoints connected to a private link service (with has limit of 1000). Comment out the summarize line to see the details of each PLS-PE connection.\n\n```kql\nresources\n| where type == \"microsoft.network/privatelinkservices\"\n| extend pec = properties.privateEndpointConnections\n| mv-expand pec\n| extend provisioningState = tostring(pec.properties.provisioningState)\n| extend status = tostring(pec.properties.privateLinkServiceConnectionState.status)\n| extend privateEndpointId = tostring(pec.properties.privateEndpoint.id)\n| extend privateEndpointLocation = tostring(pec.properties.privateEndpointLocation)\n| project subscriptionId, id, location, provisioningState, status, privateEndpointId, privateEndpointLocation\n| summarize dcount(privateEndpointId) by subscriptionId, id, location\n```\n\n## Role Assignments per subscription\n\n```kql\nauthorizationresources\n| where type == 'microsoft.authorization/roleassignments'\n| extend roleDefinitionId = tolower(tostring(properties.roleDefinitionId))\n| join kind=leftouter (authorizationresources \n                        | where type == 'microsoft.authorization/roledefinitions'\n                        | extend roleDefinitionName = tostring(properties.roleName)\n                        | extend rdId = tolower(id)\n                      ) on $left.roleDefinitionId == $right.rdId\n| extend principalType = tostring(properties.principalType)\n| extend principalId = tostring(properties.principalId)\n| extend createdOn = todatetime(properties.createdOn)\n| extend scope = tostring(properties.scope)\n| extend scopeParts = split(scope,\"/\")\n| extend scopeType = case(scope contains \"managementGroups\", \"managementGroup\",\n                          scope contains \"resourceGroups\" and array_length(scopeParts) == 5, \"resourceGroup\",\n                          scope contains \"resourceGroups\" and array_length(scopeParts) \u003e 5, \"resource\",\n                          scope contains \"subscriptions\" and array_length(scopeParts) == 3, \"subscription\",\n                          scope == \"/\", \"tenant\",\n                          \"\")\n| project id, tenantId, subscriptionId, principalType, principalId, createdOn, scopeType, scope, roleDefinitionName, roleDefinitionId\n| summarize dcount(id) by tenantId, subscriptionId\n```\n\n## Compute Quota and Usage per subscription\n\nThe Azure Resource Graph table \"quotaresources\" is mentioned in this document: \u003chttps://learn.microsoft.com/en-us/azure/quotas/how-to-guide-monitoring-alerting\u003e\n\nIt returns data similar to the response of this ARM REST API: \u003chttps://learn.microsoft.com/en-us/rest/api/compute/usage/list\u003e\n\n```kql\nquotaresources\n| where type =~ \"microsoft.compute/locations/usages\"\n| mv-expand json = properties.value limit 1000\n| extend currentValue = toint(json['currentValue'])\n| extend limitValue = toint(json['limit'])\n| extend limitName = tostring(json['name'].localizedValue)\n| extend unit = tostring(json['unit'])\n| extend usedPercent = toint((todouble(currentValue) / todouble(limitValue)) * 100)\n| where limitName contains \"vCPUs\"\n| where limitName \u003c\u003e \"Total Regional vCPUs\"\n| where currentValue \u003e 0 // only rows that have current usage\n//| where subscriptionId in (\"1\",\"2\") // only specific subscriptions\n//| where location in (\"westus3\",\"eastus\") // only specific locations\n| join kind=inner (resourcecontainers | where type =~ \"microsoft.resources/subscriptions\" | project subId = subscriptionId, subName = name) on $left.subscriptionId == $right.subId\n| project subscriptionId, subName, location, limitName, currentValue, limitValue, usedPercent\n```\n\n## Key Vault access policies\n\n```kql\nresources\n| where type == \"microsoft.keyvault/vaults\"\n| extend accessPolicies = tostring(properties.accessPolicies)\n| extend accessPolicyCount = array_length(parse_json(accessPolicies))\n| project subscriptionId, resourceGroup, name, location, accessPolicyCount\n| order by accessPolicyCount desc\n\nresources\n| where type == \"microsoft.keyvault/vaults\"\n| extend accessPolicies = parse_json(properties.accessPolicies)\n| mv-expand accessPolicies limit 2000\n| project subscriptionId, name, location, resourceGroup, accessPolicyObjectId = accessPolicies.objectId, accessPolicyTenantId = accessPolicies.tenantId, accessPolicyPermissions = accessPolicies.permissions\n| summarize accessPolicyCount = count() by subscriptionId, resourceGroup, name, location\n| order by accessPolicyCount desc\n```\n\n## Key Vault Private Endpoint Connections\n\n```kql\nresources\n| where type == \"microsoft.keyvault/vaults\"\n| extend pec = properties.privateEndpointConnections\n| mv-expand pec limit 2000\n| extend provisioningState = tostring(pec.properties.provisioningState)\n| extend status = tostring(pec.properties.privateLinkServiceConnectionState.status)\n| extend privateEndpointId = tostring(pec.properties.privateEndpoint.id)\n| extend privateEndpointLocation = tostring(pec.properties.privateEndpointLocation)\n| project subscriptionId, id, location, provisioningState, status, privateEndpointId, privateEndpointLocation\n| summarize privateEndpointCount = dcount(privateEndpointId) by subscriptionId, id, location\n| order by privateEndpointCount desc\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farsenvlad%2Fazure-resource-graph-query-examples","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farsenvlad%2Fazure-resource-graph-query-examples","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farsenvlad%2Fazure-resource-graph-query-examples/lists"}