Dig Deeper with KQL: Helping Nonprofits Understand Kusto Query Language

In our previous post about Azure Resource Graph Explorer, we introduced how nonprofits can use it to get a clearer picture of their Azure environment—what resources you have, where they’re located, and how they’re configured. But to truly harness the power of that tool, it helps to learn the language it speaks: Kusto Query Language (KQL).

If you’re using Resource Graph Explorer, you’re already working with KQL—even if you didn’t realize it.

What Is KQL?

Kusto Query Language (KQL) is a simple, structured language designed to query and analyze large datasets. In the case of Azure Resource Graph, it allows you to search across all your Azure subscriptions for details like virtual machine names, tagging status, security settings, and more.

Resources
| where type =~ "microsoft.compute/virtualmachines"
| project name, location, tags, properties.hardwareProfile.vmSize

This query pulls a list of all virtual machines, including their location, size, and tags—critical details when you're trying to organize or audit your environment.

Why Should Nonprofits Learn KQL?

For nonprofits managing cloud environments, KQL is like having a powerful search engine that looks across your Azure tenant. It’s especially useful when:

• You want to inventory resources across multiple subscriptions
• You need to check compliance with tagging or security standards
• You’re preparing for a grant report or audit and need quick data summaries
• You're looking for cost optimization opportunities

KQL makes it easy to get answers without manually digging through the Azure portal.

How KQL Fits into Azure Resource Graph Explorer

Azure Resource Graph uses KQL as its query language. The good news? It’s designed to be beginner-friendly, and you don’t need to be a developer to use it.

You’ll often start your queries with the Resources table, and then filter or project the data you want to see. Here’s another simple example:

Resources
| where tags.environment == "production"
| summarize total = count() by type

This gives you a count of all production-tagged resources, grouped by type—helpful for understanding how your infrastructure is being used.

What If You Start Using Other Microsoft Tools?

While KQL is most immediately useful in Resource Graph Explorer, the skills you build can carry over. Microsoft uses KQL across other products like:

• Microsoft Sentinel
• Azure Monitor
• Defender for Endpoint
• Log Analytics Workspace

So if your nonprofit eventually expands into those areas, you’ll already have a head start.

Resources to Learn More

Want to build your KQL confidence? Start here:

• Intro to KQL on Microsoft Learn
• Azure Resource Graph Samples
• Try editing the sample queries directly inside the Resource Graph Explorer tool in the Azure Portal

Final Thoughts

If you’re already using Azure Resource Graph Explorer, KQL isn’t just helpful—it’s essential. It allows you to ask better questions of your Azure data, which leads to smarter decisions, tighter security, and more effective use of your resources.

For nonprofits with limited time and staff, KQL offers something rare: clarity.