Azure Resource Lookup
Inventory, filter, and discover Azure resources across subscriptions.
The skill clearly restricts itself to read-only discovery and prohibits mutations through ARG, and it notes the Reader RBAC requirement, reducing external-impact risk. It does not specify user confirmation, data flows, sensitive-resource output handling, least-privilege boundaries, or recovery controls, so points are deducted.
The main workflow, tool routing, command format, and common errors are documented, making the happy path plausible. However, there is no skill-specific test or reproducible execution evidence; tool coverage and CLI/MCP routing depend on the external environment, and abnormal-input feedback is limited, so points are deducted and the static cap applies.
Use cases, trigger examples, and exclusions are relatively clear, covering inventory, tag audits, orphan discovery, and cross-subscription queries. More precise input/output contracts, false-trigger boundaries, Chinese-language support, and mainland-China network reachability are not documented, so points are deducted.
The skill has a readable SKILL.md, a reference file, quick reference, workflow, error handling, constraints, MIT licensing, author, and version metadata. It lacks a skill-level changelog, named maintenance owner and update path, fuller examples, FAQs, dependency installation notes, and a more complete limitations section, so points are deducted.
It supplies directly reusable ARG/KQL patterns, resource-type routing, and result-formatting commands for the core discovery task. However, no skill-specific execution evidence is provided, and query correctness, completeness, and benefit over dedicated tools still require review, so points are deducted under the static cap.
Concrete commands, KQL, tool names, and error cases make the material somewhat auditable. The repository also shows generic CI, evaluation workflows, and tests, but the supplied files do not establish coverage of this skill's key paths or independent reproduction, so points are deducted and the static cap applies.
- This is a static source review; Azure CLI, MCP tools, and KQL queries were not executed.
- Before use, verify Azure authentication, subscription scope, Reader permissions, the resource-graph extension, and the actual MCP tool names.
- Results may expose cross-subscription inventories, tags, and network-exposure information; apply organizational access and disclosure policies.
- ARG data is delayed and should not be treated as real-time monitoring or as an unchecked basis for security, compliance, or cost conclusions.
- No evidence was provided for Chinese-language triggering or reachability from mainland-China networks.
What does this skill do, and when should you use it?
Azure Resource Lookup lists, finds, and shows Azure resources across subscriptions and resource groups. It first checks whether a dedicated MCP tool provides full coverage, then falls back to Azure Resource Graph when needed. It supports inventory, tag audits, orphan discovery, and state-based filtering, but is not intended for deployments, resource changes, or cost analysis. The skill is part of the repository’s azure-skills plugin; the repository is MIT-licensed and actively developed.
It interprets the request, checks for a suitable dedicated MCP tool, and, when necessary, uses extension_cli_generate to produce an az graph query command. It queries Azure Resource Graph with KQL, can list subscriptions or resource groups to narrow scope, and shapes or limits results with --query, --first, and --subscriptions. Outputs may include resource inventories, resource details, missing-tag findings, orphaned-resource findings, or counts grouped by resource type or state.
- An Azure administrator needs an inventory of VMs, storage accounts, web apps, or databases across several subscriptions.
- A platform engineer needs to find unattached disks, unused NICs, or idle IP addresses.
- A governance team needs to identify resources missing required tags or stuck in unhealthy, failed, or stopped states.
- A user asks what Azure resources they have or needs resources listed within a particular resource group.
What are this skill's strengths and limitations?
- Supports inventory across subscriptions and resource types.
- Covers Web Apps and Container Apps, which lack complete dedicated listing coverage in the routing table.
- Provides guidance for tag audits, orphan discovery, and state-based filtering.
- Clearly defines when to use dedicated MCP tools versus Azure Resource Graph.
- Requires Azure CLI, the Resource Graph extension, MCP tooling, and suitable Azure read permissions.
- Resource Graph data has slight delay and is unsuitable for real-time monitoring.
- Queries are read-only and cannot deploy or change resources.
- The source does not provide standalone test coverage or platform-specific validation for this individual skill.
How do you install this skill?
Install the collection with npx skills add microsoft/skills, then select the skill in the wizard. Alternatively, clone the repository and copy .github/plugins/azure-skills/skills/azure-resource-lookup/ into the selected agent’s skill directory; the README gives .github/skills/ as an example. The source does not provide a standalone installation command for this skill.
How do you use this skill?
Install the Resource Graph extension with az extension add --name resource-graph. Then use a natural-language prompt such as “list the websites in my subscription” or “find Azure resources missing an owner tag.” The skill uses a dedicated MCP tool when full coverage exists; otherwise it generates an az graph query command through extension_cli_generate. Queries should be scoped with --subscriptions or --first.