I use Azure Resource Graph for quick, cross-subscription views of Azure resources, and writing the initial KQL query is usually easy. The challenge is what happens when a useful query becomes something the team relies on regularly.
Where do you keep those queries: shared queries, Git, PowerShell or CLI scripts, workbooks, or somewhere else? How do you handle recurring execution, run history, exceptions, and ensuring that someone follows up on the findings? Useful governance queries can easily turn into scripts that only one person understands, so I'm looking for approaches that work well when several people share responsibility for Azure governance.
3 Answers
For a straightforward Azure-native setup, save the query as a shared resource and trigger it with a Logic App. The Logic App gives you execution history, while the query resource’s activity log can show changes. Put the shared queries in a resource group with a clear owner; other people can use them, but that owner remains responsible for maintenance and investigating unexpected changes. Not every operational query needs to be managed as infrastructure-as-code.
For deployment and automation-related checks, keep the queries in a version-controlled repository and run them through a CI/CD pipeline. That gives you review history, repeatable execution, and a clear place to document what each query is checking. Ad hoc queries can stay in a personal workspace, but anything that drives governance should have an owner, source control, and an execution process.
The best home depends on the purpose. Workbooks are useful when the result needs to be explored or presented, while Git is a better fit for repeatable governance queries and scripts. If the result is a recurring CSV or report, a PowerShell or CLI wrapper stored in Git can work well. The important part is choosing a format the team can maintain rather than forcing every query into the same system.
I’m mainly thinking about recurring governance checks that produce findings, not one-off exports. I’d also like to understand whether teams keep historical results and accepted exceptions, or simply rerun the query and work from the latest output.
That seems like a practical starting point. When the Logic App finds something, do you usually notify an owner and store the results somewhere, or do you mainly rely on the run history and current query output?