Microsoft Azure Resource Graph Client Library for Python

Warnings

• breaking The credential system was completely revamped. Older authentication methods like `azure.common.credentials` or `msrestazure.azure_active_directory` are no longer supported. The `credentials` parameter has been renamed to `credential`.
  Fix: Migrate to `azure-identity` classes (e.g., `DefaultAzureCredential`) for authentication and ensure the parameter name is `credential`.
• breaking Import paths for `ResourceGraphClient`, `ResourceGraphClientConfiguration`, and models were changed. For example, `ResourceGraphClient` must now be imported directly from `azure.mgmt.resourcegraph`.
  Fix: Update import statements to directly import classes from the top-level `azure.mgmt.resourcegraph` package or its `models` submodule (e.g., `from azure.mgmt.resourcegraph import ResourceGraphClient`).
• gotcha Azure Resource Graph queries are subject to throttling and limits on the number of subscriptions and results returned. By default, queries return a maximum of 100 records and a single call can only fetch data across up to 1,000 subscriptions.
  Fix: Implement strategies like grouping/staggering queries, batching requests for subscriptions, and using the `first` parameter (up to 5000) to override the default 100-record limit for query results.
• gotcha Queries without an `order by` clause may yield different results each time they are executed due to the distributed nature of the Resource Graph service.
  Fix: Always include an `order by` clause in your KQL queries if consistent, repeatable ordering of results is required.

Install

• pip install azure-mgmt-resourcegraph azure-identity Install stable version

Imports

• ResourceGraphClient

  from azure.mgmt.resourcegraph import ResourceGraphClient

  Starting with version 2.0.0, the `ResourceGraphClient` should be imported directly from `azure.mgmt.resourcegraph`.

Quickstart

This quickstart demonstrates how to query Azure resources using `ResourceGraphClient` and `DefaultAzureCredential`. It retrieves the ID, name, type, and location of the first 5 resources in a specified Azure subscription. Ensure `AZURE_SUBSCRIPTION_ID` and appropriate authentication environment variables (e.g., `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_SECRET`) are set.

import os
from azure.identity import DefaultAzureCredential
from azure.mgmt.resourcegraph import ResourceGraphClient

# Set your Azure subscription ID in an environment variable or replace directly
subscription_id = os.environ.get('AZURE_SUBSCRIPTION_ID', 'YOUR_AZURE_SUBSCRIPTION_ID')

def main():
    if subscription_id == 'YOUR_AZURE_SUBSCRIPTION_ID':
        print("Please set the AZURE_SUBSCRIPTION_ID environment variable or replace 'YOUR_AZURE_SUBSCRIPTION_ID' in the code.")
        return

    # Authenticate using DefaultAzureCredential. It tries multiple credential types.
    # Ensure AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET (for service principal)
    # or AZURE_USERNAME, AZURE_PASSWORD (for interactive login) are set as environment variables
    # or use 'az login' for Azure CLI credential.
    credential = DefaultAzureCredential()

    # Create ResourceGraphClient
    client = ResourceGraphClient(credential)

    # Define your Kusto Query Language (KQL) query
    query_request = {
        "query": "Resources | project id, name, type, location | limit 5",
        "subscriptions": [subscription_id]
    }

    print(f"Running query on subscription: {subscription_id}")
    try:
        response = client.resources(query_request)
        for resource in response.data:
            print(f"ID: {resource['id']}, Name: {resource['name']}, Type: {resource['type']}, Location: {resource['location']}")
    except Exception as e:
        print(f"An error occurred: {e}")

if __name__ == '__main__':
    main()