Azure Resource Lookup
List, find, and discover Azure resources of any type across subscriptions and resource groups. Use Azure Resource Graph (ARG) for fast, cross-cutting queries when dedicated MCP tools don't cover the resource type.
When to invoke
Use this skill when the user wants to:
- List resources of any type (VMs, web apps, storage accounts, container apps, databases, etc.)
- Show resources in a specific subscription or resource group
- Query resources across multiple subscriptions or resource types
- Find orphaned resources (unattached disks, unused NICs, idle IPs)
- Discover resources missing required tags or configurations
- Get a resource inventory spanning multiple types
- Find resources in a specific state (unhealthy, failed provisioning, stopped)
- Answer "what resources do I have?" or "show me my Azure resources"
- List web apps, websites, or App Services
⚠️ Warning: App Service / Web Apps have no dedicated MCP list command. Prompts like "list websites", "list web apps", or "list app services" must route through this skill to use Azure Resource Graph.
💡 Tip: For single-resource-type queries, first check if a dedicated MCP tool can handle it (see routing table below). If none exists, use Azure Resource Graph.
Quick Reference
| Property |
Value |
| Query Language |
KQL (Kusto Query Language subset) |
| CLI Command |
az graph query -q "<KQL>" -o table |
| Extension |
az extension add --name resource-graph |
| MCP Tool |
extension_cli_generate with intent for az graph query |
| Best For |
Cross-subscription queries, orphaned resources, tag audits |
MCP Tools
| Tool |
Purpose |
When to Use |
extension_cli_generate |
Generate az graph query commands |
Primary tool — generate ARG queries from user intent |
mcp_azure_mcp_subscription_list |
List available subscriptions |
Discover subscription scope before querying |
mcp_azure_mcp_group_list |
List resource groups |
Narrow query scope |
Workflow
Step 1: Check for a Dedicated MCP Tool
For single-resource-type queries, check if a dedicated MCP tool can handle it:
| Resource Type |
MCP Tool |
Coverage |
| Virtual Machines |
compute |
✅ Full — list, details, sizes |
| Storage Accounts |
storage |
✅ Full — accounts, blobs, tables |
| Cosmos DB |
cosmos |
✅ Full — accounts, databases, queries |
| Key Vault |
keyvault |
⚠️ Partial — secrets/keys only, no vault listing |
| SQL Databases |
sql |
⚠️ Partial — requires resource group name |
| Container Registries |
acr |
✅ Full — list registries |
| Kubernetes (AKS) |
aks |
✅ Full — clusters, node pools |
| App Service / Web Apps |
appservice |
❌ No list command — use ARG |
| Container Apps |
— |
❌ No MCP tool — use ARG |
| Event Hubs |
eventhubs |
✅ Full — namespaces, hubs |
| Service Bus |
servicebus |
✅ Full — queues, topics |
If a dedicated tool is available with full coverage, use it. Otherwise proceed to Step 2.
Step 2: Generate the ARG Query
Use extension_cli_generate to build the az graph query command:
mcp_azure_mcp_extension_cli_generate
intent: "query Azure Resource Graph to <user's request>"
cli-type: "az"
See Azure Resource Graph Query Patterns for common KQL patterns.
Step 3: Execute and Format Results
Run the generated command. Use --query (JMESPath) to shape output:
az graph query -q "<KQL>" --query "data[].{name:name, type:type, rg:resourceGroup}" -o table
Use --first N to limit results. Use --subscriptions to scope.
Error Handling
| Error |
Cause |
Fix |
resource-graph extension not found |
Extension not installed |
az extension add --name resource-graph |
AuthorizationFailed |
No read access to subscription |
Check RBAC — need Reader role |
BadRequest on query |
Invalid KQL syntax |
Verify table/column names; use =~ for case-insensitive type matching |
| Empty results |
No matching resources or wrong scope |
Check --subscriptions flag; verify resource type spelling |
Constraints
- ✅ Always use
=~ for case-insensitive type matching (types are lowercase)
- ✅ Always scope queries with
--subscriptions or --first for large tenants
- ✅ Prefer dedicated MCP tools for single-resource-type queries
- ❌ Never use ARG for real-time monitoring (data has slight delay)
- ❌ Never attempt mutations through ARG (read-only)
Output template
## Resource lookup result
**Status:** found | empty | blocked
**Summary:** <one sentence covering scope and outcome>
### Details
Matching resources with type, resource group, region, and subscription.
### Validation
- <check performed>: <result and evidence>
Quality gate
1---2name: azure-resource-lookup3description: List, find, and show Azure resources across subscriptions or resource groups using Azure Resource Graph queries. Use when the user asks to list websites, web apps, app services, virtual machines, storage accounts, or container apps, asks what resources they have, wants a resource inventory, searches resources by tag, runs tag analysis, discovers orphaned resources or unattached disks, counts resources by type, or performs a cross-subscription lookup.4license: MIT5---67<!-- Generated from harness/github-copilot/skills/azure-resource-lookup/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->89# Azure Resource Lookup1011List, find, and discover Azure resources of any type across subscriptions and resource groups. Use Azure Resource Graph (ARG) for fast, cross-cutting queries when dedicated MCP tools don't cover the resource type.1213## When to invoke1415Use this skill when the user wants to:16- **List resources** of any type (VMs, web apps, storage accounts, container apps, databases, etc.)17- **Show resources** in a specific subscription or resource group18- Query resources **across multiple subscriptions** or resource types19- Find **orphaned resources** (unattached disks, unused NICs, idle IPs)20- Discover resources **missing required tags** or configurations21- Get a **resource inventory** spanning multiple types22- Find resources in a **specific state** (unhealthy, failed provisioning, stopped)23- Answer "**what resources do I have?**" or "**show me my Azure resources**"24- **List web apps, websites, or App Services**2526> ⚠️ **Warning:** App Service / Web Apps have no dedicated MCP `list` command. Prompts like "list websites", "list web apps", or "list app services" **must** route through this skill to use Azure Resource Graph.2728> 💡 **Tip:** For single-resource-type queries, first check if a dedicated MCP tool can handle it (see routing table below). If none exists, use Azure Resource Graph.2930## Quick Reference3132| Property | Value |33|----------|-------|34| **Query Language** | KQL (Kusto Query Language subset) |35| **CLI Command** | `az graph query -q "<KQL>" -o table` |36| **Extension** | `az extension add --name resource-graph` |37| **MCP Tool** | `extension_cli_generate` with intent for `az graph query` |38| **Best For** | Cross-subscription queries, orphaned resources, tag audits |3940## MCP Tools4142| Tool | Purpose | When to Use |43|------|---------|-------------|44| `extension_cli_generate` | Generate `az graph query` commands | Primary tool — generate ARG queries from user intent |45| `mcp_azure_mcp_subscription_list` | List available subscriptions | Discover subscription scope before querying |46| `mcp_azure_mcp_group_list` | List resource groups | Narrow query scope |4748## Workflow4950### Step 1: Check for a Dedicated MCP Tool5152For single-resource-type queries, check if a dedicated MCP tool can handle it:5354| Resource Type | MCP Tool | Coverage |55|---|---|---|56| Virtual Machines | `compute` | ✅ Full — list, details, sizes |57| Storage Accounts | `storage` | ✅ Full — accounts, blobs, tables |58| Cosmos DB | `cosmos` | ✅ Full — accounts, databases, queries |59| Key Vault | `keyvault` | ⚠️ Partial — secrets/keys only, no vault listing |60| SQL Databases | `sql` | ⚠️ Partial — requires resource group name |61| Container Registries | `acr` | ✅ Full — list registries |62| Kubernetes (AKS) | `aks` | ✅ Full — clusters, node pools |63| App Service / Web Apps | `appservice` | ❌ No list command — use ARG |64| Container Apps | — | ❌ No MCP tool — use ARG |65| Event Hubs | `eventhubs` | ✅ Full — namespaces, hubs |66| Service Bus | `servicebus` | ✅ Full — queues, topics |6768If a dedicated tool is available with full coverage, use it. Otherwise proceed to Step 2.6970### Step 2: Generate the ARG Query7172Use `extension_cli_generate` to build the `az graph query` command:7374```yaml75mcp_azure_mcp_extension_cli_generate76 intent: "query Azure Resource Graph to <user's request>"77 cli-type: "az"78```7980See [Azure Resource Graph Query Patterns](references/azure-resource-graph.md) for common KQL patterns.8182### Step 3: Execute and Format Results8384Run the generated command. Use `--query` (JMESPath) to shape output:8586```bash87az graph query -q "<KQL>" --query "data[].{name:name, type:type, rg:resourceGroup}" -o table88```8990Use `--first N` to limit results. Use `--subscriptions` to scope.9192## Error Handling9394| Error | Cause | Fix |95|-------|-------|-----|96| `resource-graph extension not found` | Extension not installed | `az extension add --name resource-graph` |97| `AuthorizationFailed` | No read access to subscription | Check RBAC — need Reader role |98| `BadRequest` on query | Invalid KQL syntax | Verify table/column names; use `=~` for case-insensitive type matching |99| Empty results | No matching resources or wrong scope | Check `--subscriptions` flag; verify resource type spelling |100101## Constraints102103- ✅ **Always** use `=~` for case-insensitive type matching (types are lowercase)104- ✅ **Always** scope queries with `--subscriptions` or `--first` for large tenants105- ✅ **Prefer** dedicated MCP tools for single-resource-type queries106- ❌ **Never** use ARG for real-time monitoring (data has slight delay)107- ❌ **Never** attempt mutations through ARG (read-only)108109## Output template110111```markdown112## Resource lookup result113114**Status:** found | empty | blocked115**Summary:** <one sentence covering scope and outcome>116117### Details118Matching resources with type, resource group, region, and subscription.119120### Validation121- <check performed>: <result and evidence>122```123124## Quality gate125126- [ ] The query scope is stated and matches the user request.127- [ ] Only read operations were performed.128- [ ] The output follows `## Output template` exactly.129- [ ] Every reported check was performed and its evidence is shown.130- [ ] Irreversible Azure actions were confirmed with the user first.
paulasilvatech