Azure resource lookup skill: find and list Azure resources with Resource Graph

Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 27 October 2026

What is the Azure resource lookup skill?

The Azure resource lookup skill teaches a coding agent how to answer "what do I have in Azure?" It lists, finds and counts resources of any type across subscriptions and resource groups, using a dedicated Azure MCP tool where one covers the resource type and an Azure Resource Graph query everywhere else.

Its description opens: "List, find, and show Azure resources across subscriptions or resource groups." It also spells out what it won't do: deploying or changing resources goes to azure-deploy, cost optimization goes to a skill in the optional azure-cost plugin, and other clouds are out of scope.

The skill ships in microsoft/azure-skills, the Azure Skills Plugin. The README lists it under "Troubleshoot, monitor, and govern" and says the repo is synced automatically from microsoft/GitHub-Copilot-for-Azure. The SKILL.md frontmatter gives version 1.2.3, author Microsoft and license MIT.

As of 27 October 2026, its skills.sh page listed about 566,300 installs (snapshot, 27 October 2026).

What does it do?

The folder holds two files: a SKILL.md of about 5.6 KB and references/azure-resource-graph.md, a library of Kusto Query Language (KQL) patterns. The workflow has three steps.

1. Check for a dedicated MCP tool. For a single resource type, the agent first looks at a routing table:

The skill flags the App Service gap in a warning: "App Service / Web Apps have no dedicated MCP list command." That's why prompts such as "list my web apps" are part of its trigger list.

2. Generate a Resource Graph query. Otherwise the agent calls the Azure MCP extension_cli_generate tool with an intent such as "query Azure Resource Graph to" plus your request, which returns an az graph query command.

3. Run it and shape the output. The skill's pattern is:

az graph query -q "<KQL>" --query "data[].{name:name, type:type, rg:resourceGroup}" -o table

It tells the agent to scope big tenants with --subscriptions or --first N, and to use =~ for case-insensitive type matching because resource types are stored in lowercase.

The query library. The reference file groups ready-made KQL by job:

• Inventory: count resources by type, by type and location, across subscriptions with subscription names, or everything in one resource group.
• Orphaned resources: unattached managed disks, public IPs with no IP configuration, network interfaces with no VM, load balancers with no backend pools.
• Tags and exposure: resources missing an Environment or CostCenter tag, tag coverage by type, and resources with public network access enabled.
• Health: resources that aren't Available, active service health incidents, and failed provisioning states.
• Services: App Services with their plans, Container Apps, VNets and subnets, and Azure Advisor cost recommendations.

The commands match Microsoft's Resource Graph quickstart for the Azure CLI, which installs the extension with az extension add --name resource-graph and notes that the CLI prompts you to install it the first time you run az graph.

How do you install the Azure resource lookup skill?

The repo README documents several routes. The plugin is the closer fit, because steps 1 and 2 of the workflow call Azure MCP tools that the plugin wires in.

Claude Code: the Azure Skills Plugin. Run inside Claude Code:

/plugin install azure@claude-plugins-official

Or run /plugin and search for "azure". See Claude Code plugins and Claude Code MCP.

GitHub Copilot CLI:

/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills

Codex, Cursor and Gemini CLI. For Codex, the README says to run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins. For Cursor, use the Cursor Marketplace or Settings, then Plugins. For Gemini CLI, run gemini extensions install https://github.com/microsoft/azure-skills. See Codex skills and Cursor skills.

Skill only. The command on skills.sh copies just this folder:

npx skills add https://github.com/microsoft/azure-skills --skill azure-resource-lookup

Without Azure MCP, the agent can still run the az graph query commands directly, since the skill and its reference spell them out.

Prerequisites, per the README: an Azure account or subscription, Node.js 18 or later on your PATH (npx starts the MCP servers), and the Azure CLI signed in with az login. The skills CLI used for the skill-only route needs Node.js 22.20 or later, per its README. Microsoft's quickstart says the Resource Graph extension needs Azure CLI 2.22.0 or later.

How do you use it?

Ask in plain language. The skill is model-invoked, so the agent loads it when your request matches trigger phrases such as "what resources do I have", "list my VMs", "find resources by tag" and "unattached disks".

Example prompts (suggestions; the first is the README's MCP check):

• List my Azure resource groups.
• List the web apps in my subscription with their App Service plans.
• Find unattached managed disks and unused public IPs across all my subscriptions.
• Which resources are missing an Environment or CostCenter tag? Show coverage by type.
• Count resources by type in the prod-eu resource group.

Expect a table. For a single resource type with full MCP coverage, such as storage accounts, the agent should use that tool instead of Resource Graph.

Tips and limits

From the repo, Microsoft Learn and skills.sh, not from testing:

• It's read-only by design. The constraints say "Never attempt mutations through ARG (read-only)." Cleaning up the orphaned disks it finds is a separate task you approve yourself.
• Data isn't live. The skill says never to use Resource Graph for real-time monitoring because "data has slight delay." For live metrics or logs, use azure-diagnostics.
• Permissions limit results. A query returns only what your identity can read. The skill's error table says AuthorizationFailed means you need the Reader role, and empty results often mean a wrong --subscriptions scope.
• Cost questions go elsewhere. It finds orphaned resources but says it is "not for cost analysis". The README lists azure-cost for cost work.
• Treat resource metadata as untrusted. On skills.sh, Gen Agent Trust Hub rated the skill Pass (Safe) on 3 October 2026, noting that resource names and tags shown to the agent could carry instructions. Socket and Snyk both rated it Pass on 3 October 2026.
• Telemetry. The README says to set AZURE_MCP_COLLECT_TELEMETRY=false to turn off Azure MCP telemetry.

The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.

Save it in your Kipt library

An edited copy pays off if your team has standard tags or subscriptions the stock queries don't know, such as a required Owner tag instead of CostCenter. In Kipt, open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip. The copy carries the skill files, not the plugin's MCP setup. Skills in your private GitHub repo install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Microsoft.

Similar skills

• Azure resource visualizer skill: turns one resource group into a Mermaid architecture diagram.
• Azure compliance skill: checks resources against Azure best practices instead of just listing them.
• Azure diagnostics skill: live troubleshooting with logs and metrics.
• Azure storage skill: deeper storage account and blob work once you've found the account.
• Azure deploy skill: the skill the lookup skill points to for changing resources.