PluginBench
Skill
Official
Pass
Audit score 90

azure-resource-lookup

microsoft/azure-skills

List, find, and discover Azure resources across subscriptions and resource groups using Azure Resource Graph

What is azure-resource-lookup?

azure-resource-lookup is a skill for coding agents that enables querying, listing, and discovering Azure resources of any type. It routes single-resource-type requests to dedicated MCP tools when available, and falls back to Azure Resource Graph (ARG) KQL queries for unsupported types like App Services and Container Apps. It covers resource inventory, orphaned resource discovery, tag audits, cross-subscription lookups, and state-based filtering. It does not handle deployments, cost analysis, or non-Azure clouds.

  • Lists Azure resources by type (VMs, web apps, storage accounts, container apps, databases, etc.) across subscriptions or resource groups
  • Routes queries to dedicated MCP tools (compute, storage, AKS, etc.) when full coverage is available
  • Generates and executes Azure Resource Graph KQL queries via `az graph query` for unsupported resource types
  • Finds orphaned resources such as unattached disks, unused NICs, and idle IPs
  • Audits resources for missing tags or specific configurations
  • Filters resources by provisioning state (failed, stopped, unhealthy)

How to install azure-resource-lookup

npx skills add https://github.com/microsoft/azure-skills --skill azure-resource-lookup
Prerequisites
  • Azure CLI installed and authenticated (`az login`)
  • `resource-graph` CLI extension installed (`az extension add --name resource-graph`)
  • Reader RBAC role on the target subscriptions
  • Node.js and npx available to install the skill
Claude Code
Cursor
Windsurf
Cline

How to use azure-resource-lookup

  1. 1.Install the skill: `npx skills add https://github.com/microsoft/azure-skills --skill azure-resource-lookup`
  2. 2.Prompt your agent with a resource lookup request, e.g. 'list my web apps' or 'find unattached disks'
  3. 3.The skill checks if a dedicated MCP tool (compute, storage, AKS, etc.) covers the resource type
  4. 4.If a dedicated tool exists with full coverage, it is used directly
  5. 5.If no dedicated tool exists (e.g. App Services, Container Apps), the skill generates an `az graph query` KQL command via `extension_cli_generate`
  6. 6.The generated command is executed; use `--subscriptions` to scope and `--first N` to limit results
  7. 7.Results are formatted using JMESPath `--query` and `-o table` for readability
  8. 8.If errors occur (missing extension, auth failure, bad KQL), follow the error handling table in the skill

Use cases

Good for
  • List all web apps or App Services in a subscription (no dedicated MCP list command exists)
  • Find all unattached managed disks across multiple subscriptions
  • Audit resources missing required tags across a tenant
  • Get a full resource inventory grouped by type or resource group
  • Discover Container Apps when no dedicated MCP tool is available
Who it's for
  • Azure developers who need a quick resource inventory without opening the portal
  • Platform engineers auditing resources across multiple subscriptions
  • DevOps teams identifying orphaned or misconfigured resources
  • Coding agents (Claude Code, Cursor) handling Azure resource lookup prompts

azure-resource-lookup FAQ

Why can't I use this skill to list App Services with a dedicated MCP tool?

The `appservice` MCP tool has no list command. The skill explicitly routes 'list web apps' and similar prompts through Azure Resource Graph instead.

Can this skill deploy or modify resources?

No. Azure Resource Graph is read-only. For deployments or changes, use the azure-deploy skill.

Can I query resources across multiple subscriptions at once?

Yes. Use the `--subscriptions` flag on `az graph query` to scope across multiple subscription IDs.

What query language does Azure Resource Graph use?

A subset of KQL (Kusto Query Language). Use `=~` for case-insensitive type matching since resource types are stored in lowercase.

Is this skill suitable for cost analysis?

No. Use the azure-cost skill for cost optimization. This skill covers resource discovery and inventory only.

Full instructions (SKILL.md)

Source of truth, from microsoft/azure-skills.


name: azure-resource-lookup description: "List, find, and show Azure resources across subscriptions or resource groups. Handles prompts like "list the websites in my subscription", "list my web apps", "show my app services", "list virtual machines", "list my VMs", "show storage accounts", "find container apps", and "what resources do I have". USE FOR: list websites, list web apps, list app services, show websites in subscription, resource inventory, find resources by tag, tag analysis, orphaned resource discovery (not for cost analysis), unattached disks, count resources by type, cross-subscription lookup, and Azure Resource Graph queries. DO NOT USE FOR: deploying/changing resources (use azure-deploy), cost optimization (use azure-cost), or non-Azure clouds." license: MIT metadata: author: Microsoft version: "1.1.3"

Azure Resource Lookup

List, find, and discover Azure resources of any type across subscriptions and resource groups. Use Azure Resource Graph (ARG) for fast, cross-cutting queries when dedicated MCP tools don't cover the resource type.

When to Use This Skill

Use this skill when the user wants to:

  • List resources of any type (VMs, web apps, storage accounts, container apps, databases, etc.)
  • Show resources in a specific subscription or resource group
  • Query resources across multiple subscriptions or resource types
  • Find orphaned resources (unattached disks, unused NICs, idle IPs)
  • Discover resources missing required tags or configurations
  • Get a resource inventory spanning multiple types
  • Find resources in a specific state (unhealthy, failed provisioning, stopped)
  • Answer "what resources do I have?" or "show me my Azure resources"
  • List web apps, websites, or App Services

⚠️ Warning: App Service / Web Apps have no dedicated MCP list command. Prompts like "list websites", "list web apps", or "list app services" must route through this skill to use Azure Resource Graph.

💡 Tip: For single-resource-type queries, first check if a dedicated MCP tool can handle it (see routing table below). If none exists, use Azure Resource Graph.

Quick Reference

PropertyValue
Query LanguageKQL (Kusto Query Language subset)
CLI Commandaz graph query -q "<KQL>" -o table
Extensionaz extension add --name resource-graph
MCP Toolextension_cli_generate with intent for az graph query
Best ForCross-subscription queries, orphaned resources, tag audits

MCP Tools

ToolPurposeWhen to Use
extension_cli_generateGenerate az graph query commandsPrimary tool — generate ARG queries from user intent
mcp_azure_mcp_subscription_listList available subscriptionsDiscover subscription scope before querying
mcp_azure_mcp_group_listList resource groupsNarrow query scope

Workflow

Step 1: Check for a Dedicated MCP Tool

For single-resource-type queries, check if a dedicated MCP tool can handle it:

Resource TypeMCP ToolCoverage
Virtual Machinescompute✅ Full — list, details, sizes
Storage Accountsstorage✅ Full — accounts, blobs, tables
Cosmos DBcosmos✅ Full — accounts, databases, queries
Key Vaultkeyvault⚠️ Partial — secrets/keys only, no vault listing
SQL Databasessql⚠️ Partial — requires resource group name
Container Registriesacr✅ Full — list registries
Kubernetes (AKS)aks✅ Full — clusters, node pools
App Service / Web Appsappservice❌ No list command — use ARG
Container Apps❌ No MCP tool — use ARG
Event Hubseventhubs✅ Full — namespaces, hubs
Service Busservicebus✅ Full — queues, topics

If a dedicated tool is available with full coverage, use it. Otherwise proceed to Step 2.

Step 2: Generate the ARG Query

Use extension_cli_generate to build the az graph query command:

mcp_azure_mcp_extension_cli_generate
  intent: "query Azure Resource Graph to <user's request>"
  cli-type: "az"

See Azure Resource Graph Query Patterns for common KQL patterns.

Step 3: Execute and Format Results

Run the generated command. Use --query (JMESPath) to shape output:

az graph query -q "<KQL>" --query "data[].{name:name, type:type, rg:resourceGroup}" -o table

Use --first N to limit results. Use --subscriptions to scope.

Error Handling

ErrorCauseFix
resource-graph extension not foundExtension not installedaz extension add --name resource-graph
AuthorizationFailedNo read access to subscriptionCheck RBAC — need Reader role
BadRequest on queryInvalid KQL syntaxVerify table/column names; use =~ for case-insensitive type matching
Empty resultsNo matching resources or wrong scopeCheck --subscriptions flag; verify resource type spelling

Constraints

  • Always use =~ for case-insensitive type matching (types are lowercase)
  • Always scope queries with --subscriptions or --first for large tenants
  • Prefer dedicated MCP tools for single-resource-type queries
  • Never use ARG for real-time monitoring (data has slight delay)
  • Never attempt mutations through ARG (read-only)