Troubleshoot errors using Azure Resource Graph

You might run into errors when querying Azure resources with Azure Resource Graph. This article describes various errors that might occur and how to resolve them.

Most errors are the result of an issue while running a query with Azure Resource Graph. When a query fails, the SDK provides details about the failed query. This information indicates the issue so that it can be fixed and a later query succeeds.

Customers making large or frequent resource queries have requests throttled.

Azure Resource Graph allocates a quota number for each user based on a time window. For example, a user can send at most 15 queries within every 5-second window without being throttled. The quota value is determined by many factors and is subject to change. For more information, see Throttling in Azure Resource Graph.

There are several methods of dealing with throttled requests:

• Grouping queries
• Staggering queries
• Query in Parallel
• Pagination

Customers with access to more than 1,000 subscriptions, including cross-tenant subscriptions with Azure Lighthouse, can't fetch data across all subscriptions in a single call to Azure Resource Graph.

Azure CLI and PowerShell forward only the first 1,000 subscriptions to Azure Resource Graph. The REST API for Azure Resource Graph accepts a maximum number of subscriptions to perform the query on.

Batch requests for the query with a subset of subscriptions to stay under the 1,000 subscription limit. The solution is using the Subscription parameter in PowerShell.

# Replace this query with your own
$query = 'Resources | project type'

# Fetch the full array of subscription IDs
$subscriptions = Get-AzSubscription
$subscriptionIds = $subscriptions.Id

# Create a counter, set the batch size, and prepare a variable for the results
$counter = [PSCustomObject] @{ Value = 0 }
$batchSize = 1000
$response = @()

# Group the subscriptions into batches
$subscriptionsBatch = $subscriptionIds | Group -Property { [math]::Floor($counter.Value++ / $batchSize) }

# Run the query for each batch
foreach ($batch in $subscriptionsBatch){ $response += Search-AzGraph -Query $query -Subscription $batch.Group }

# View the completed results of the query on all subscriptions
$response

Customers querying the Azure Resource Graph REST API get a 500 (Internal Server Error) response returned.

The Azure Resource Graph REST API only supports a Content-Type of application/json. Some REST tools or agents default to text/plain, which is unsupported by the REST API.

Validate that the tool or agent you're using to query Azure Resource Graph has the REST API header Content-Type configured for application/json.

Customers that explicitly pass a list of subscriptions with an Azure Resource Graph query get a 403 (Forbidden) response.

If the customer doesn't have read permission to all the provided subscriptions, the request is denied because of lack of appropriate security rights.

Include at least one subscription in the subscription list that the customer running the query has at least read access to. For more information, see Permissions in Azure Resource Graph.

There are specific fields, when using Azure Resource Graph, that are updated at a slower cadence. These fields will converge to true values over time, provided there are no updates in between.

• properties.extended.instanceView.osName
• properties.extended.instanceView.osVersion
• properties.extended.instanceView.computerName

Some fields are coming from agent blobs that don't have notification coverage, therefore updates to these fields are delayed.

These fields update at a slower cadence today, but will converge to true values over time, provided there are no updates in between.

If you didn't see your problem or are unable to solve your issue, visit the support:

Azure support site and submit your request.