canonical: https://jentic.com/apis/azure.com/azure-resource-graph

# Microsoft Azure Azure Resource Graph

Jentic publishes the only available OpenAPI specification for Azure Resource Graph, keeping it validated and agent-ready. Azure Resource Graph runs Kusto Query Language (KQL) queries across every Azure resource a caller has access to, returning structured JSON results. The 2019-04-01 surface exposes the resources query endpoint and the operations listing for the Microsoft.ResourceGraph provider, the foundation for cross-subscription inventory, FinOps, and policy reporting.

## For AI agents

Run KQL queries across every Azure resource in scope using the Microsoft.ResourceGraph resources endpoint and return structured JSON for inventory, FinOps, and policy reporting.

## Scope

Does not handle log queries, metric ingestion, or resource provisioning - use for KQL queries over Azure resource inventory only.

## Capabilities

- Run a Kusto query across every Azure subscription a caller has access to
- Project specific resource fields like type, location, and tags into a tabular result set
- Page large query results using $skipToken returned by the resources endpoint
- Filter resources by management group or a list of subscription ids in a single request
- Aggregate resource counts by type, region, or tag for inventory dashboards
- List the operations exposed by the Microsoft.ResourceGraph provider for RBAC discovery

## Use cases

### Cross-Subscription Resource Inventory

Run a single KQL query against the resources endpoint to enumerate every resource type across hundreds of subscriptions in a tenant, returning a paged JSON result. The query body accepts a list of subscriptionIds or a managementGroupId and a Kusto string, and the response includes a $skipToken for paging through large result sets. This replaces fan-out scripts that hit each subscription's Resource Manager list endpoints in turn.

Example prompt: POST a query 'Resources | summarize count() by type | order by count_ desc' across the caller's subscriptions and return the top 10 resource types

### Tag Compliance Reporting

Use Resource Graph to find every resource missing a required tag like costCentre or environment so the report can be wired into a remediation workflow. A KQL query like 'Resources | where isnull(tags.costCentre) | project id, type, location, resourceGroup' returns the gap list across subscriptions in seconds. Pair with $skipToken for tenants with thousands of non-compliant resources.

Example prompt: POST the KQL query 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup' and return every untagged resource id

### FinOps Cost Allocation by Resource Type

Aggregate resource counts by SKU and region as the input for a FinOps dashboard that ties spend back to deployment patterns. The resources endpoint accepts an aggregation KQL query and returns deterministic JSON, which the dashboard ingests on a schedule. Combined with Azure Cost Management, this gives finance a unit-economics view (cost per VM SKU per region) that pure billing data does not.

Example prompt: POST 'Resources | where type == "microsoft.compute/virtualmachines" | summarize count() by tostring(properties.hardwareProfile.vmSize), location' and return the result

### Agent-Driven Cloud Discovery via Jentic

An AI agent uses Jentic to run ad-hoc KQL queries against Azure Resource Graph as part of a broader cloud automation, for example finding candidate workloads for a migration or reservation purchase. The agent searches Jentic for 'query all azure resources', loads the schema, and executes any supplied KQL string. Azure AD bearer tokens are sourced from your Jentic One instance per call, so the agent never handles raw secrets.

Example prompt: Search Jentic for 'query all azure resources', execute 'Resources | summarize count() by subscriptionId', and emit the per-subscription resource count

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /providers/Microsoft.ResourceGraph/resources | Run a KQL query across Azure resources in scope |
| GET | /providers/Microsoft.ResourceGraph/operations | List Microsoft.ResourceGraph operations |

## Key resources

- **Resources Query** — Run a KQL query across every Azure subscription or management group the caller has access to.
- **Operations** — List the operations exposed by the Microsoft.ResourceGraph provider for RBAC and discovery.

## Why Jentic

- **Setup:** Wiring Azure Resource Graph by hand means registering an Azure AD app, minting tokens for https://management.azure.com/, and building your own $skipToken paging loop while respecting the per-user query quota returned in x-ms-user-quota-remaining. Through Jentic you install once, import Azure Resource Graph from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This surface exposes only the resources query and an operations listing, both read-only, so limit the agent to the operations it needs, such as running a KQL query over resource inventory. The query itself reads only the subscriptions and management groups the credential already has access to, and no write or delete operation exists on this surface to add.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'query all azure resources' or 'count Azure resources by type', and Jentic returns the Microsoft.ResourceGraph resources operation with its input schema so the agent supplies the KQL string and subscription scope without browsing the ARM reference.

## Related APIs

- **Azure Resource Graph Query** — Persist named KQL queries that you can re-run via the resources endpoint.
- **Azure Log Analytics** — Run KQL queries over log and metric data rather than resource inventory.
- **Azure Reservation** — Manages Azure reservations once Resource Graph identifies coverage gaps.

## FAQ

### Why is there no official OpenAPI spec for Azure Resource Graph?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Resource Graph via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure Resource Graph API use?

The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from your Jentic One instance and injected at call time so the agent never sees the raw client secret.

### Can I query resources across every subscription in my tenant in one call?

Yes. POST to /providers/Microsoft.ResourceGraph/resources with a body that lists subscriptions or supplies a managementGroupId and a KQL query string. The response is paginated via $skipToken for queries that return more than the per-call result limit.

### What are the rate limits for the Azure Resource Graph API?

Resource Graph applies a per-user quota measured in queries per 5 seconds, with the remaining budget returned in the x-ms-user-quota-remaining response header. Throttle locally when the remaining value approaches zero rather than waiting for HTTP 429.

### How do I run a KQL query across all my Azure resources through Jentic?

Search Jentic for 'query all azure resources', load the schema for POST /providers/Microsoft.ResourceGraph/resources, supply a body with your subscriptions and KQL string, and execute. Jentic injects the Azure AD bearer token automatically.

### Is the Azure Resource Graph API free?

Yes - Resource Graph queries themselves are free. Subject to per-user quota and throttling, you are not billed for the queries; only the underlying Azure resources you read about incur their own usage charges.

### Can I limit what my agent is allowed to do with the Azure Resource Graph API?

Yes. Because Jentic One is self-hosted, you set the rules for which operations and credentials your agent may use, and this surface exposes only two read-only operations: running a KQL query over resource inventory and listing the Microsoft.ResourceGraph operations. You can restrict the agent to just the resources query and withhold anything else, and since no write or delete operation exists here, the agent cannot change or remove any resource. Each query also reads only the subscriptions and management groups your stored Azure AD credential already has access to, so scope is bounded by both your operation rules and the credential's own permissions.