Microsoft Azure Azure Resource Graph

Name: Azure Resource Graph API
Brand: Azure Resource Graph
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth22 EndpointsREST

For Agents

Run KQL queries across every Azure resource in scope using the Microsoft.ResourceGraph resources endpoint and return structured JSON for inventory, FinOps, and policy reporting.

Install Jentic One Beta

Connect the Azure Resource Graph to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Resource Graph, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure Resource Graph API.

Run a Kusto query across every Azure subscription a caller has access to

Project specific resource fields like type, location, and tags into a tabular result set

Page large query results using $skipToken returned by the resources endpoint

GET STARTED

Start building with Azure Resource Graph API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Azure Resource Graph API for, with concrete tasks.

★ Cross-Subscription Resource Inventory

Run a single KQL query against the resources endpoint to enumerate every resource type across hundreds of subscriptions in a tenant, returning a paged JSON result. The query body accepts a list of subscriptionIds or a managementGroupId and a Kusto string, and the response includes a $skipToken for paging through large result sets. This replaces fan-out scripts that hit each subscription's Resource Manager list endpoints in turn.

POST a query 'Resources | summarize count() by type | order by count_ desc' across the caller's subscriptions and return the top 10 resource types

Tag Compliance Reporting

Use Resource Graph to find every resource missing a required tag like costCentre or environment so the report can be wired into a remediation workflow. A KQL query like 'Resources | where isnull(tags.costCentre) | project id, type, location, resourceGroup' returns the gap list across subscriptions in seconds. Pair with $skipToken for tenants with thousands of non-compliant resources.

POST the KQL query 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup' and return every untagged resource id

FinOps Cost Allocation by Resource Type

Aggregate resource counts by SKU and region as the input for a FinOps dashboard that ties spend back to deployment patterns. The resources endpoint accepts an aggregation KQL query and returns deterministic JSON, which the dashboard ingests on a schedule. Combined with Azure Cost Management, this gives finance a unit-economics view (cost per VM SKU per region) that pure billing data does not.

POST 'Resources | where type == "microsoft.compute/virtualmachines" | summarize count() by tostring(properties.hardwareProfile.vmSize), location' and return the result

Agent-Driven Cloud Discovery via Jentic

An AI agent uses Jentic to run ad-hoc KQL queries against Azure Resource Graph as part of a broader cloud automation, for example finding candidate workloads for a migration or reservation purchase. The agent searches Jentic for 'query all azure resources', loads the schema, and executes any supplied KQL string. Azure AD bearer tokens are sourced from the Jentic vault per call, so the agent never handles raw secrets.

Search Jentic for 'query all azure resources', execute 'Resources | summarize count() by subscriptionId', and emit the per-subscription resource count

Key Endpoints

2 endpoints — jentic publishes the only available openapi specification for azure resource graph, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/providers/Microsoft.ResourceGraph/resources

Run a KQL query across Azure resources in scope

GET

/providers/Microsoft.ResourceGraph/operations

List Microsoft.ResourceGraph operations

POST

/providers/Microsoft.ResourceGraph/resources

Run a KQL query across Azure resources in scope

GET

/providers/Microsoft.ResourceGraph/operations

List Microsoft.ResourceGraph operations

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD client credentials are stored encrypted in the Jentic vault. A short-lived bearer token scoped to https://management.azure.com/ is fetched per call; raw client secrets and refresh tokens never reach the agent context.

Intent-based discovery

Agents search Jentic by intent (e.g., 'query all azure resources') and receive the Microsoft.ResourceGraph resources operation with its full input schema so the agent supplies the KQL query and subscription scope without browsing the ARM reference.

Time to first call

Direct integration with Microsoft.ResourceGraph: half a day for ARM auth and pagination handling. Through Jentic: under an hour from search to first successful query.

FAQs

Specific to using Azure Resource Graph API through Jentic.

Why is there no official OpenAPI spec for Azure Resource Graph?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Resource Graph via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Azure Resource Graph API use?

The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from the Jentic vault and injected at call time so the agent never sees the raw client secret.

Can I query resources across every subscription in my tenant in one call?

Yes. POST to /providers/Microsoft.ResourceGraph/resources with a body that lists subscriptions or supplies a managementGroupId and a KQL query string. The response is paginated via $skipToken for queries that return more than the per-call result limit.

What are the rate limits for the Azure Resource Graph API?

Resource Graph applies a per-user quota measured in queries per 5 seconds, with the remaining budget returned in the x-ms-user-quota-remaining response header. Throttle locally when the remaining value approaches zero rather than waiting for HTTP 429.

How do I run a KQL query across all my Azure resources through Jentic?

Search Jentic for 'query all azure resources', load the schema for POST /providers/Microsoft.ResourceGraph/resources, supply a body with your subscriptions and KQL string, and execute. Jentic injects the Azure AD bearer token automatically.

Is the Azure Resource Graph API free?

Yes — Resource Graph queries themselves are free. Subject to per-user quota and throttling, you are not billed for the queries; only the underlying Azure resources you read about incur their own usage charges.