KQL Cheat Sheet for Azure Resource Graph

Why This Matters

No Azure cert teaches operational KQL. AZ-104 shows 2 sample queries. That's it.

Here's what you actually need: queries for 31,000+ resource environments.

Essential Queries

Complete VM Inventory

Resources
| where type == "microsoft.compute/virtualmachines"
| extend NetworkInterfaceId = tostring(properties.networkProfile.networkInterfaces[0].id)
| join kind=leftouter (
    Resources
    | where type == "microsoft.network/networkinterfaces"
    | project NetworkInterfaceId = id, 
              PrivateIP = tostring(properties.ipConfigurations[0].properties.privateIPAddress)
) on NetworkInterfaceId
| project VMName = name, PrivateIP, resourceGroup, location

Find Untagged Resources

Resources
| where isnull(tags) or array_length(bag_keys(tags)) == 0
| project name, type, resourceGroup
| order by type

Public IP Audit

Resources
| where type =~ 'microsoft.network/publicipaddresses'
| extend ipAddress = properties.ipAddress,
         associatedResource = properties.ipConfiguration.id
| project name, ipAddress, associatedResource, resourceGroup

Performance Tips

1. Filter early: | where type == ... before other operations
2. Project only needed columns: Reduces memory usage
3. Use in for multiple conditions: Faster than or

Full Guide

45+ queries with performance optimization, SQL translation, and advanced techniques:

👉 Complete KQL Cheat Sheet

---

Questions? Drop them in comments. Managing Azure at scale? These queries save hours daily.