Troubleshoot Azure Resource Graph alerts

Note

Azure Resource Graph alerts integration with Log Analytics is in public preview.

The following descriptions help you troubleshoot queries for Azure Resource Graph alerts that integrate with Log Analytics.

Operators and functions

Many supported operators in Azure Resource Graph Explorer work with the Log Analytics integration for alerts.

But because Azure Resource Graph alerts is in preview, there are operators and functions that work in Azure Resource Graph but are unsupported with the Log Analytics integration.

The following are known unsupported operators and functions:

Operator/function	Type
join	operator The integration works when you join an Azure Resource Graph table with a Log Analytics table. The integration doesn't work if you join two or more Azure Resource Graph tables.
mv-apply	operator
arg_min()	scalar function
avg(), avgif()	aggregation function
percentile(), percentiles(), percentilew(), percentilesw()	aggregation function
rand()	scalar function
stdev(), stdevif(), stdevp()	aggregation function
variance(), varianceif(), variancep()	aggregation function
Using keys with bag functions	scalar function

For more information about operators and functions, go to tabular operators, scalar functions, and aggregation functions.

Pagination

Azure Resource Graph has pagination in its dedicated APIs. But with the way Log Analytics interacts with Azure Resource Graph, pagination isn't a supported reason why only 1,000 results are returned.

• Cross queries between Azure Resource Graph and Log Analytics don't support pagination and only show the first 1,000 results.
• You must set a limitation of 400 when writing a query with the mv-expand operator.

Managed identities

The managed identity for your alert must have the role Log Analytics Contributor or Log Analytics Reader. The role provides the permissions to get monitoring information.

When you set up an alert, the results can be different than the result after the alert is fired. The reason is that a fired alert is run using a managed identity, but when you manually test an alert it uses the user's identity.

Table names

Azure Resource Graph table names need to be camel case with the first letter of each word capitalized, like Resources or ResourceContainers. You can also use lowercase like resources or resourcecontainers.