Mastering Azure Resource Graph: Query & Analyse Tags with KQL

Azure Resource Graph is a tool that can be used to query information about your Azure resources.  Using Kusto Query Language (KQL) you can pull together tables and charts that can either be downloaded or displayed inside Azure Dashboards or Workbooks. 

In this blog post I want to walk you through how to use Azure Resource Graph and KQL to work with Azure Resource Tags. 

Azure Resource Tags

Best practice within Azure says you should tag your resource groups, resources etc, with meaningful metadata.  Often people create resource tags to identify what resources are used in a specific project, used by a specific department, or even a tag to show when a resource was created. 

Tagging your resources is really helpful in identifying resources relating to project, department etc when you want to cross charge or even just doing audits. 

You can query tags with Azure Resource Graph explorer, however the data comes back as a block of JSON inside a single column.  This means you cannot filter or aggregate the data on an individual tag. 

Tag Kusto query

If we open up Azure Resource Graph Explorer and run the KQL query:

resources
| where type =~ 'microsoft.hybridcompute/machines' or type =~'Microsoft.Compute/virtualMachines'
| project name, ['tags']

We get the following result back

As you can see the tag result is given back to us in JSON format. 

If we use the extend operator to parse the JSON string into a dynamic object we can start to pull the information into something we can work with. 

resources
| where type =~ 'microsoft.hybridcompute/machines' or type =~ 'Microsoft.Compute/virtualMachines'
| extend TagsObject = parse_json(tags)  // Parse the JSON string into a dynamic object
| project name, City = tostring(TagsObject.City), Environment = tostring(TagsObject.Environment)  // Extract the City & Environment tags separately

We can then use the summarize function to group by the City tag and count how many occurrences we have of that. 

resources
| where type =~ 'microsoft.hybridcompute/machines' or type =~ 'Microsoft.Compute/virtualMachines'
| extend TagsObject = parse_json(tags)  // Parse the JSON string into a dynamic object
| project name, City = tostring(TagsObject.City), Environment = tostring(TagsObject.Environment)  // Extract the City tag as a string
| summarize CityCount = count() by City // Group by City and count occurrences

This method is useful when you need to generate reports on how many resources belong to different locations, teams, or environments.

Conclusion

Azure Resource Graph, combined with KQL, provides a powerful way to extract, analyse, and report on Azure resource metadata. By using JSON parsing and aggregation techniques, you can transform raw data into actionable insights.

If you’re managing multiple Azure resources and need to ensure proper tagging, Resource Graph Explorer can help you gain better visibility into your environment. Try out these queries in your own environment and see what insights you can uncover!