Azure Resources
Discover, inventory, and visualize existing Azure resources. Combines two
related capabilities:
- Lookup mode — query and list resources (single type or cross-cutting via
Azure Resource Graph). Replaces the legacy
azure-resource-lookup skill.
- Visualize mode — analyze a resource group and generate a detailed Mermaid
architecture diagram. Replaces the legacy
azure-resource-visualizer skill.
Both modes share references/azure-resource-graph.md for KQL patterns.
Mode A: Lookup
Use this mode when the user wants to list / find / show Azure resources.
When to Use Lookup
- List resources of any type (VMs, web apps, storage accounts, container apps, databases, etc.)
- Show resources in a specific subscription or resource group
- Query resources across multiple subscriptions or resource types
- Find orphaned resources (unattached disks, unused NICs, idle IPs)
- Discover resources missing required tags or configurations
- Get a resource inventory spanning multiple types
- Find resources in a specific state (unhealthy, failed provisioning, stopped)
- Answer "what resources do I have?" or "show me my Azure resources"
💡 Tip: For single-resource-type queries, first check if a dedicated MCP
tool can handle it (see routing table below). If none exists, use Azure
Resource Graph (ARG).
Quick Reference
| Property |
Value |
| Query Language |
KQL (Kusto Query Language subset) |
| CLI Command |
az graph query -q "<KQL>" -o table |
| Extension |
az extension add --name resource-graph |
| MCP Tool |
extension_cli_generate with intent for az graph query |
| Best For |
Cross-subscription queries, orphaned resources, tag audits |
MCP Tools
| Tool |
Purpose |
When to Use |
extension_cli_generate |
Generate az graph query commands |
Primary — generate ARG queries from user intent |
mcp_azure-mcp_subscription_list |
List available subscriptions |
Discover subscription scope before querying |
mcp_azure-mcp_group_list |
List resource groups |
Narrow query scope |
Rules
- Prefer dedicated MCP tools for single-resource-type queries (
compute, storage, cosmos, etc.) before falling back to Azure Resource Graph
- Use ARG for cross-cutting queries — cross-subscription, cross-type, orphaned resources, tag audits
- Generate queries via
extension_cli_generate — do not hand-author KQL when intent-based generation is available
- Shape output with
--query JMESPath for tabular display; do not load raw JSON dumps into context
- Mode A is read-only — lookup never modifies resources; remediation is out of scope (use
azure-deploy)
- Mode B (Visualize) is for documentation — emit Mermaid only when the user explicitly asks for a diagram; do not auto-visualize lookup results
- Out of scope: deploying resources (use
azure-deploy), cost optimization (use azure-cost-optimization), security scanning (use azure-compliance), troubleshooting (use azure-diagnostics)
Lookup Workflow
Three-step procedure: (1) check for a dedicated MCP tool by resource type
(compute / storage / cosmos / keyvault / sql / acr / aks /
appservice / eventhubs / servicebus); (2) if no full-coverage tool, generate an
Azure Resource Graph query via extension_cli_generate; (3) execute with --query
JMESPath shaping. Full per-resource-type tool table and example commands in
references/lookup-workflow.md.
Lookup Constraints
- ✅ Always use
=~ for case-insensitive type matching (types are lowercase)
- ✅ Always scope queries with
--subscriptions or --first for large tenants
- ✅ Prefer dedicated MCP tools for single-resource-type queries
- ❌ Never use ARG for real-time monitoring (data has slight delay)
- ❌ Never attempt mutations through ARG (read-only)
Lookup Error Handling
| Error |
Cause |
Fix |
resource-graph extension not found |
Extension not installed |
az extension add --name resource-graph |
AuthorizationFailed |
No read access to subscription |
Check RBAC — need Reader role |
BadRequest on query |
Invalid KQL syntax |
Verify table/column names; use =~ for case-insensitive match |
| Empty results |
No matching resources or wrong scope |
Check --subscriptions flag; verify resource type spelling |
Mode B: Visualize
Use this mode when the user asks for a diagram of a resource group, or to
understand how individual resources fit together.
When to Use Visualize
The user wants to:
- Create an architecture diagram of an existing resource group
- See how resources connect (VNets, private endpoints, identities, app settings)
- Document deployed infrastructure with embedded Mermaid
For the full Visualize-mode procedure (resource discovery, diagram construction, file creation, quality standards, constraints, edge cases, and output format), load references/visualize.md.
Reference Index
Load these on demand — do NOT read all at once:
| Reference |
Mode |
When to Load |
references/azure-resource-graph.md |
Both |
KQL patterns, ARG query examples |
references/visualize.md |
Visualize |
Full Visualize-mode workflow (Steps 2–4, constraints) |
assets/example-diagram.md |
Visualize |
Sample completed Mermaid architecture diagram |
assets/template-architecture.md |
Visualize |
Markdown template for the generated documentation |
1---2name: azure-resources3description: **ANALYSIS SKILL** — List, find, and visualize Azure resources via Resource Graph or Mermaid. WHEN: 'list resources', 'list VMs', 'find orphaned resources', 'resource inventory', 'cross-subscription query', 'visualize Azure resources', 'diagram my resources'. DO NOT USE FOR: deploys (azure-deploy), cost (azure-cost-optimization), security (azure-compliance), troubleshooting (azure-diagnostics).4license: MIT5---67# Azure Resources89Discover, inventory, and visualize existing Azure resources. Combines two10related capabilities:1112- **Lookup mode** — query and list resources (single type or cross-cutting via13 Azure Resource Graph). Replaces the legacy `azure-resource-lookup` skill.14- **Visualize mode** — analyze a resource group and generate a detailed Mermaid15 architecture diagram. Replaces the legacy `azure-resource-visualizer` skill.1617Both modes share `references/azure-resource-graph.md` for KQL patterns.1819---2021# Mode A: Lookup2223Use this mode when the user wants to **list / find / show** Azure resources.2425## When to Use Lookup2627- **List resources** of any type (VMs, web apps, storage accounts, container apps, databases, etc.)28- **Show resources** in a specific subscription or resource group29- Query resources **across multiple subscriptions** or resource types30- Find **orphaned resources** (unattached disks, unused NICs, idle IPs)31- Discover resources **missing required tags** or configurations32- Get a **resource inventory** spanning multiple types33- Find resources in a **specific state** (unhealthy, failed provisioning, stopped)34- Answer "**what resources do I have?**" or "**show me my Azure resources**"3536> 💡 **Tip:** For single-resource-type queries, first check if a dedicated MCP37> tool can handle it (see routing table below). If none exists, use Azure38> Resource Graph (ARG).3940## Quick Reference4142| Property | Value |43| ------------------ | ---------------------------------------------------------- |44| **Query Language** | KQL (Kusto Query Language subset) |45| **CLI Command** | `az graph query -q "<KQL>" -o table` |46| **Extension** | `az extension add --name resource-graph` |47| **MCP Tool** | `extension_cli_generate` with intent for `az graph query` |48| **Best For** | Cross-subscription queries, orphaned resources, tag audits |4950## MCP Tools5152| Tool | Purpose | When to Use |53| --------------------------------- | ---------------------------------- | ----------------------------------------------- |54| `extension_cli_generate` | Generate `az graph query` commands | Primary — generate ARG queries from user intent |55| `mcp_azure-mcp_subscription_list` | List available subscriptions | Discover subscription scope before querying |56| `mcp_azure-mcp_group_list` | List resource groups | Narrow query scope |5758## Rules5960- **Prefer dedicated MCP tools** for single-resource-type queries (`compute`, `storage`, `cosmos`, etc.) before falling back to Azure Resource Graph61- **Use ARG for cross-cutting queries** — cross-subscription, cross-type, orphaned resources, tag audits62- **Generate queries via `extension_cli_generate`** — do not hand-author KQL when intent-based generation is available63- **Shape output with `--query` JMESPath** for tabular display; do not load raw JSON dumps into context64- **Mode A is read-only** — lookup never modifies resources; remediation is out of scope (use `azure-deploy`)65- **Mode B (Visualize) is for documentation** — emit Mermaid only when the user explicitly asks for a diagram; do not auto-visualize lookup results66- **Out of scope**: deploying resources (use `azure-deploy`), cost optimization (use `azure-cost-optimization`), security scanning (use `azure-compliance`), troubleshooting (use `azure-diagnostics`)6768## Lookup Workflow6970Three-step procedure: (1) check for a dedicated MCP tool by resource type71(`compute` / `storage` / `cosmos` / `keyvault` / `sql` / `acr` / `aks` /72`appservice` / `eventhubs` / `servicebus`); (2) if no full-coverage tool, generate an73Azure Resource Graph query via `extension_cli_generate`; (3) execute with `--query`74JMESPath shaping. Full per-resource-type tool table and example commands in75[`references/lookup-workflow.md`](references/lookup-workflow.md).7677## Lookup Constraints7879- ✅ **Always** use `=~` for case-insensitive type matching (types are lowercase)80- ✅ **Always** scope queries with `--subscriptions` or `--first` for large tenants81- ✅ **Prefer** dedicated MCP tools for single-resource-type queries82- ❌ **Never** use ARG for real-time monitoring (data has slight delay)83- ❌ **Never** attempt mutations through ARG (read-only)8485## Lookup Error Handling8687| Error | Cause | Fix |88| ------------------------------------ | ------------------------------------ | -------------------------------------------------------------- |89| `resource-graph extension not found` | Extension not installed | `az extension add --name resource-graph` |90| `AuthorizationFailed` | No read access to subscription | Check RBAC — need Reader role |91| `BadRequest` on query | Invalid KQL syntax | Verify table/column names; use `=~` for case-insensitive match |92| Empty results | No matching resources or wrong scope | Check `--subscriptions` flag; verify resource type spelling |9394---9596# Mode B: Visualize9798Use this mode when the user asks for a **diagram** of a resource group, or to99understand how individual resources fit together.100101## When to Use Visualize102103The user wants to:104105- Create an architecture diagram of an existing resource group106- See how resources connect (VNets, private endpoints, identities, app settings)107- Document deployed infrastructure with embedded Mermaid108109For the full Visualize-mode procedure (resource discovery, diagram construction, file creation, quality standards, constraints, edge cases, and output format), load **[references/visualize.md](references/visualize.md)**.110111---112113## Reference Index114115Load these on demand — do NOT read all at once:116117| Reference | Mode | When to Load |118| ------------------------------------ | --------- | ----------------------------------------------------- |119| `references/azure-resource-graph.md` | Both | KQL patterns, ARG query examples |120| `references/visualize.md` | Visualize | Full Visualize-mode workflow (Steps 2–4, constraints) |121| `assets/example-diagram.md` | Visualize | Sample completed Mermaid architecture diagram |122| `assets/template-architecture.md` | Visualize | Markdown template for the generated documentation |
jonathan-vella