Azure Resource Graph Queries

Results include only the subscriptions and resources that the querying identity is authorized to view.

VNet address spaces

Lists every VNet and its configured address prefixes (CIDR ranges).

Resources | where type =~ 'Microsoft.Network/virtualNetworks' | project name, properties.addressSpace.addressPrefixes

VNets with connected devices (with tags)

Lists VNets that have at least one NIC or private endpoint attached to any of their subnets, along with ApplicationName, BusinessUnit, workload_name, and business_unit tag values for ownership tracking.

Resources | where type =~ 'microsoft.network/virtualnetworks' | mv-expand subnet = properties.subnets | extend nicCount = array_length(subnet.properties.ipConfigurations) | extend peCount = array_length(subnet.properties.privateEndpoints) | extend applicationName = tostring(tags.ApplicationName) | extend businessUnit = tostring(tags.BusinessUnit) | extend workload_name = tostring(tags.workload_name) | extend business_unit = tostring(tags.business_unit) | summarize TotalNics = sum(coalesce(nicCount, 0)), TotalPrivateEndpoints = sum(coalesce(peCount, 0)) by vnetName = name, resourceGroup, subscriptionId, id, applicationName, businessUnit, workload_name, business_unit | where TotalNics > 0 or TotalPrivateEndpoints > 0 | project vnetName, applicationName, businessUnit, workload_name, business_unit, resourceGroup, subscriptionId, id

VNets with no connected devices (with tags)

Lists VNets with no reported NIC or private endpoint connections. The left outer expansion preserves VNets whose subnet collection is empty or null, so VNets with no subnets are included in the results.

Resources | where type =~ 'microsoft.network/virtualnetworks' | mv-expand kind=leftouter subnet = properties.subnets | extend nicCount = array_length(subnet.properties.ipConfigurations) | extend peCount = array_length(subnet.properties.privateEndpoints) | extend applicationName = tostring(tags.ApplicationName) | extend businessUnit = tostring(tags.BusinessUnit) | extend workload_name = tostring(tags.workload_name) | extend business_unit = tostring(tags.business_unit) | summarize TotalNics = sum(coalesce(nicCount, 0)), TotalPrivateEndpoints = sum(coalesce(peCount, 0)) by vnetName = name, resourceGroup, subscriptionId, id, applicationName, businessUnit, workload_name, business_unit | where TotalNics == 0 and TotalPrivateEndpoints == 0 | project vnetName, applicationName, businessUnit, workload_name, business_unit, resourceGroup, subscriptionId, id