Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 27 October 2026
What is the Azure Kusto skill?
The Azure Kusto skill teaches a coding agent to query Azure Data Explorer (also called Kusto or ADX) with the Kusto Query Language: find your clusters and databases, read a table's schema, then write and run KQL for logs, telemetry and time series. It is for developers and SREs who want to ask questions of their data in plain language from Claude Code, Codex or Copilot instead of hand-writing every query.
Its description reads: "Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis." The trigger list that follows includes "KQL queries", "ADX clusters", "IoT telemetry" and "anomaly detection."
The skill ships in microsoft/azure-skills, the Azure Skills Plugin. The README lists it under "Work across data, AI, identity, and platform services" and says the repo is synced automatically from microsoft/GitHub-Copilot-for-Azure. The SKILL.md frontmatter lists version 1.2.2 and author Microsoft.
As of 27 October 2026, its skills.sh page listed about 567,100 installs (snapshot, 27 October 2026).
What does it do?
The folder holds a single file: a SKILL.md of about 8.5 KB. There are no scripts or reference files.
A four-step workflow. Discover resources, explore the schema, query the data, analyze the results. Step 1 adds a rule: if the table's location is unknown and several clusters, databases or workspaces could hold it, batch the search and "only report 'not found' after all candidates are checked."
Six query patterns, each with a KQL example:
| Pattern | What it shows |
|---|---|
| Basic retrieval | where Timestamp > ago(1h) then take 100 |
| Aggregation | summarize count() by EventType, bin(Timestamp, 1h) |
| Time series | averages and percentiles(ResponseTime, 50, 95, 99) in 5 minute bins, rendered as a timechart |
| Join and correlation | an inner join of error events and critical logs on CorrelationId |
| Schema discovery | the kusto_table_schema_get tool before writing queries |
| Batch search | listing tables in each candidate source, then union workspace('ws1').Requests, workspace('ws2').Requests |
The operators match Microsoft's KQL documentation, and the patterns suit what Microsoft's Azure Data Explorer overview describes the service for: log analytics, time series analytics and IoT data.
MCP tools first. The skill names four Azure MCP Server tools: kusto_cluster_list, kusto_database_list, kusto_query and kusto_table_schema_get. They take a subscription, cluster, database, and the query or table name, with optional resource group and tenant.
A CLI fallback. If the MCP tools fail, time out (the skill says "queries > 60 seconds"), hit connection or auth errors, or return nothing from a database known to have data, the agent switches to az kusto cluster list, az kusto database list and the matching show commands. For queries it posts to the cluster's REST endpoint:
az rest --method post \
--url "https://<cluster>.<region>.kusto.windows.net/v1/rest/query" \
--body "{ \"db\": \"<database>\", \"csl\": \"<kql-query>\" }"
Best practices and troubleshooting. It tells the agent to filter early on time, use take or limit for exploration, push aggregation into summarize, and use project to keep only needed columns. The Common Issues list covers access denied (Viewer role minimum), timeouts, syntax errors, empty results, a cluster name entered with the .kusto.windows.net suffix, and ingestion lag of "1-30 second delay depending on ingestion method."
How do you install the Azure Kusto skill?
The repo README documents several routes. The full plugin fits best, because the skill's main path runs through the Azure MCP Server that the plugin wires in.
Claude Code: the Azure Skills Plugin. Run inside Claude Code:
/plugin install azure@claude-plugins-official
Or run /plugin and search for "azure". Update later with /plugin update azure@claude-plugins-official. See Claude Code plugins and Claude Code MCP.
GitHub Copilot CLI:
/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills
Codex, Cursor and Gemini CLI. For Codex, the README says to run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins. For Cursor, use the Cursor Marketplace or Settings, then Plugins. For Gemini CLI, run gemini extensions install https://github.com/microsoft/azure-skills. See Codex skills and Cursor skills.
Skill only. The command on skills.sh copies just this folder:
npx skills add https://github.com/microsoft/azure-skills --skill azure-kusto
With the skill alone, the agent has no Kusto MCP tools unless you set up the Azure MCP Server yourself, so it will lean on the CLI fallback.
Prerequisites, per the README: an Azure account or subscription, Node.js 18 or later on your PATH for npx, and the Azure CLI signed in with az login. Service principal sign-in through AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET is also documented.
How do you use it?
Name the cluster and database if you know them, and describe the question rather than the query. The skill is model-invoked, so mentioning KQL, Kusto, ADX or telemetry analysis is usually enough.
Example prompts (suggestions, not quotes from the repo):
List my Azure Data Explorer clusters and the databases in each.Show me the schema of the Requests table in the telemetry database on cluster prodlogs.Write a KQL query for p50, p95 and p99 response time in 5 minute bins over the last 24 hours.Find error events in the last hour and join them to critical log lines by CorrelationId.I don't know which workspace has the AppTraces table. Check all of them before telling me it's missing.
Expect the agent to read the schema before it writes a query, and to start with a small take when it's exploring. Check that the time range in the query matches what you asked; the skill lists overly tight time filters as a common cause of empty results.
Tips and limits
From the repo, Microsoft Learn and skills.sh, not from testing:
- Treat query results as untrusted. On skills.sh, Snyk rated the skill Warn (medium risk) on 10 October 2026, flagging third-party content exposure: logs and telemetry can contain user-submitted text that the agent reads. Gen Agent Trust Hub rated it Pass (Safe) on 10 October 2026, noting the same indirect prompt injection surface and that the skill defines no boundary markers. Socket rated it Pass on 10 October 2026.
- It reads; it doesn't build. Although the overview mentions resource management, the tools and CLI commands only list and show clusters and databases. It doesn't create clusters, tables or ingestion pipelines.
- Queries cost compute. The skill warns that broad queries cause high CPU use. Add time filters and limits before running anything against a large production table.
- One small file. All guidance is in the SKILL.md, so the KQL coverage is a starting set of patterns, not a full language reference. Microsoft's KQL documentation covers the rest.
- Telemetry. The README says to set
AZURE_MCP_COLLECT_TELEMETRY=falseto turn off Azure MCP telemetry.
The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.
Save it in your Kipt library
An edited copy is worth keeping if you query the same clusters every week: add your cluster names, table names and the KQL functions your team already relies on, and the agent stops guessing. In Kipt, open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip. The copy carries the skill file only, not the plugin's MCP setup. Skills in your private GitHub repo install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
Kipt is not affiliated with Microsoft.
Similar skills
- Azure diagnostics skill: troubleshoots live Azure apps, often the reason you're querying logs in the first place.
- Azure storage skill: Microsoft's reference for Blob, Files, Queue, Table and Data Lake storage.
- Azure AI skill: AI Search, Speech and Document Intelligence, from the same plugin.
- Azure compliance skill: scans resources against Azure best practices.
- Postgres best practices skill: query and schema guidance if your data lives in Postgres instead.