Cost Governance & Guardrails

Check Azure Policy cost guardrails (SKU/region restrictions), cost-allocation tag compliance, and budget coverage across a scope. All policy lookups go through Azure Resource Graph (policyresources table).

ARG queries against policyresources require read access at the scope. Empty results may mean the caller lacks visibility into assigned policies — not that none exist.

All ARG queries below take subscription-id placeholders (<sub-id-1>, <sub-id-2>) — replace with the target subscriptions. To target a management group, first resolve member subs via ResourceContainers | where type == 'microsoft.resources/subscriptions' | where properties.managementGroupAncestorsChain has '<mg-name>' | project subscriptionId.

Run every ARG query through the generate → validate → execute workflow. The queries below are ready to run, but pass each one to validate_query first — it confirms the syntax and property paths before you spend a call on execute_query. If you need to adapt a query to a different resource type or field, draft it with generate_query (a natural-language prompt), then validate and execute.

Step 1: List Policy Assignments

Call execute_query to enumerate policy assignments and read their parameters. Don't filter by subscriptionId — MG- and tenant-level assignments cascade down to subscriptions, and filtering would drop them.