How to query the contents of all subscriptions with Kusto using Graph Explorer?

Question

Is it possible to query all subscriptions in a tenant and list every resource beneath them using Graph Explorer? I have 30 subscriptions and I'd like to export but all of my KQL queries come back empty.

Answer 1

Hi @Quincy Sanders
We can query all subscriptions in a tenant and list every resource beneath them using Azure Resource Graph Explorer in the below steps:
Using Azure Resource Graph API:

1.Ensure you have the right permissions and use Azure AD for authentication.
2.Use the Resource Graph API to query resources across all subscriptions with a KQL query.

POST https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2020-04-01
Authorization: Bearer {access-token}
Content-Type: application/json
{
  "subscriptions": [
    "{subscription-id-1}",
    "{subscription-id-2}",
    "{subscription-id-3}"
  ],
  "query": "Resources | project name, type, location"
}

KQL Query Example:

Resources
| project name, location, type
| where type =~ 'Microsoft.Compute/virtualMachines'
| order by name desc

Power Shell:

$subs = Get-AzureRmSubscription
foreach ($sub in $subs) {
  Select-AzureRmSubscription -SubscriptionId $sub.SubscriptionId
  $vms = Get-AzureRmVm
  foreach ($vm in $vms) {
    write-host $vm.Name, $vm.Location
  }
}

We can export data from Resource Graph Explorer to a CSV file using the Azure portal or use PowerShell's Export-Csv.
Ensure all subscriptions are in scope and you have the necessary permissions and double-check the KQL queries for errors.

Refere:https://stackoverflow.com/questions/65256301/kql-query-to-retrieve-azure-subscription-name-resource-group-resource-name-re
https://learn.microsoft.com/en-us/answers/questions/644264/calling-multiple-subscriptions-in-kql

Please let me know if you required anything!