Microsoft Azure Azure Resource Graph

Name: Azure Resource Graph API
Brand: Azure Resource Graph
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth22 Endpoints

Install Jentic One Beta

Connect the Azure Resource Graph to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Resource Graph, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure Resource Graph API.

Run a Kusto query across every Azure subscription a caller has access to

Project specific resource fields like type, location, and tags into a tabular result set

Page large query results using $skipToken returned by the resources endpoint

GET STARTED

Start building with Azure Resource Graph API

Explore with Jentic

View OpenAPI Document

For Agents

Run KQL queries across every Azure resource in scope using the Microsoft.ResourceGraph resources endpoint and return structured JSON for inventory, FinOps, and policy reporting.

Use for: Query every virtual machine across all my Azure subscriptions, I want to count Azure resources by type and region, Find all storage accounts that are missing a costCentre tag, List all Azure resources tagged environment=prod

Not supported: Does not handle log queries, metric ingestion, or resource provisioning - use for KQL queries over Azure resource inventory only.

Use Cases

Patterns agents use Azure Resource Graph API for, with concrete tasks.

★ Cross-Subscription Resource Inventory

Run a single KQL query against the resources endpoint to enumerate every resource type across hundreds of subscriptions in a tenant, returning a paged JSON result. The query body accepts a list of subscriptionIds or a managementGroupId and a Kusto string, and the response includes a $skipToken for paging through large result sets. This replaces fan-out scripts that hit each subscription's Resource Manager list endpoints in turn.

POST a query 'Resources | summarize count() by type | order by count_ desc' across the caller's subscriptions and return the top 10 resource types

Tag Compliance Reporting

Use Resource Graph to find every resource missing a required tag like costCentre or environment so the report can be wired into a remediation workflow. A KQL query like 'Resources | where isnull(tags.costCentre) | project id, type, location, resourceGroup' returns the gap list across subscriptions in seconds. Pair with $skipToken for tenants with thousands of non-compliant resources.

POST the KQL query 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup' and return every untagged resource id

FinOps Cost Allocation by Resource Type

Aggregate resource counts by SKU and region as the input for a FinOps dashboard that ties spend back to deployment patterns. The resources endpoint accepts an aggregation KQL query and returns deterministic JSON, which the dashboard ingests on a schedule. Combined with Azure Cost Management, this gives finance a unit-economics view (cost per VM SKU per region) that pure billing data does not.

POST 'Resources | where type == "microsoft.compute/virtualmachines" | summarize count() by tostring(properties.hardwareProfile.vmSize), location' and return the result

Agent-Driven Cloud Discovery via Jentic

An AI agent uses Jentic to run ad-hoc KQL queries against Azure Resource Graph as part of a broader cloud automation, for example finding candidate workloads for a migration or reservation purchase. The agent searches Jentic for 'query all azure resources', loads the schema, and executes any supplied KQL string. Azure AD bearer tokens are sourced from your Jentic One instance per call, so the agent never handles raw secrets.

Search Jentic for 'query all azure resources', execute 'Resources | summarize count() by subscriptionId', and emit the per-subscription resource count

Key Endpoints

2 endpoints — jentic publishes the only available openapi specification for azure resource graph, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/providers/Microsoft.ResourceGraph/resources

Run a KQL query across Azure resources in scope

GET

/providers/Microsoft.ResourceGraph/operations

List Microsoft.ResourceGraph operations

POST

/providers/Microsoft.ResourceGraph/resources

Run a KQL query across Azure resources in scope

GET

/providers/Microsoft.ResourceGraph/operations

List Microsoft.ResourceGraph operations

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'query all azure resources' or 'count Azure resources by type', and Jentic returns the Microsoft.ResourceGraph resources operation with its input schema so the agent supplies the KQL string and subscription scope without browsing the ARM reference.

Time to first call

FAQs

Specific to using Azure Resource Graph API through Jentic.

Why is there no official OpenAPI spec for Azure Resource Graph?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Resource Graph via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Azure Resource Graph API use?

The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from your Jentic One instance and injected at call time so the agent never sees the raw client secret.

Can I query resources across every subscription in my tenant in one call?

Yes. POST to /providers/Microsoft.ResourceGraph/resources with a body that lists subscriptions or supplies a managementGroupId and a KQL query string. The response is paginated via $skipToken for queries that return more than the per-call result limit.

What are the rate limits for the Azure Resource Graph API?

Resource Graph applies a per-user quota measured in queries per 5 seconds, with the remaining budget returned in the x-ms-user-quota-remaining response header. Throttle locally when the remaining value approaches zero rather than waiting for HTTP 429.

How do I run a KQL query across all my Azure resources through Jentic?

Search Jentic for 'query all azure resources', load the schema for POST /providers/Microsoft.ResourceGraph/resources, supply a body with your subscriptions and KQL string, and execute. Jentic injects the Azure AD bearer token automatically.

Is the Azure Resource Graph API free?

Yes - Resource Graph queries themselves are free. Subject to per-user quota and throttling, you are not billed for the queries; only the underlying Azure resources you read about incur their own usage charges.

Can I limit what my agent is allowed to do with the Azure Resource Graph API?

Yes. Because Jentic One is self-hosted, you set the rules for which operations and credentials your agent may use, and this surface exposes only two read-only operations: running a KQL query over resource inventory and listing the Microsoft.ResourceGraph operations. You can restrict the agent to just the resources query and withhold anything else, and since no write or delete operation exists here, the agent cannot change or remove any resource. Each query also reads only the subscriptions and management groups your stored Azure AD credential already has access to, so scope is bounded by both your operation rules and the credential's own permissions.