Context
Azure Resource Graph queries indexed resource information across the scopes a principal can read. A returned list is not automatically a complete tenant inventory or an atomic snapshot. Permission filtering, pagination and recent changes can all explain a count that differs from another view.
Prerequisites are the inventory's purpose, expected subscription list, querying principal and required resource types. Obtain permission to inspect the intended scopes and retain query metadata. Define whether the task needs operational discovery or a strict point-in-time record, since Graph's consistency model affects that choice.
1. Verify scope before counting resources
Record the principal and explicit subscriptions or management group used for the query. Compare them with the approved inventory scope. A principal can receive results from accessible subscriptions without proving it can read every subscription requested. A missing permission can therefore look like an empty environment.
Check query filters and supported resource properties. A type filter, location predicate or missing nested property can exclude expected resources. Validate one known resource of each required type. Refresh the tool's account context if subscriptions were added during an existing login session.
2. Read every result page
Inspect count, totalRecords, resultTruncated and continuation information rather than only the returned array. Use supported paging with an unchanged query and scopes. Project stable resource IDs and sort by a unique identifier when appropriate. A query containing take or limit is a sample, not an export of the complete matching set.
Preserve page-level metadata and deduplicate by resource ID in the inventory consumer. Some query shapes do not provide a continuation token. Check the documented restrictions instead of treating a missing token as proof that no more records exist. Keep all raw IDs needed to audit how the final count was produced.
3. Reconcile changing resources
Graph updates asynchronously and is not strongly consistent. Resources created, deleted or changed while pagination proceeds can create duplicate or missing observations even with sorting. Record the collection start and end times and the environment's change activity.
For important discrepancies, inspect the resource directly through its provider and rerun the narrowly affected scope after indexing catches up. Consider partitioning collection by subscription or another stable boundary for large environments. Such approaches improve manageability but do not create an atomic global snapshot. State the inventory's practical consistency limits in its report.
Diagnostic checkpoints
| Observation | Possible cause | Next evidence |
|---|---|---|
| Whole subscription absent | Scope or permission | Principal access inventory |
| Export stops at a round page size | Incomplete pagination | Truncation and token metadata |
| Newly created resource missing | Indexing delay | Direct provider read |
| Duplicate or shifting page entries | Concurrent change | IDs and collection timestamps |
Illustrative scenario
A hypothetical asset exporter reads only the first result page and labels it the tenant inventory. Its count appears stable despite newly onboarded subscriptions. Reviewing pagination and principal scope reveals two independent completeness gaps. This is an illustrative exporter design case without a claimed customer asset count.
Verification and inventory SOP
Compare the final unique IDs with known sentinel resources in every expected scope. Reconcile unexplained differences with direct reads and document recently changing resources. Acceptance should include scope coverage and pagination evidence, not just a plausible total.
Maintain query versions, principal ownership, expected scopes and collection timestamps in the SOP. Monitor unexpected count changes alongside access changes and query errors. Review exports after resource-type additions or schema changes so an apparently successful query does not silently narrow the inventory.
Explore Clouvenix observability monitoring for implementation and operational handover.