{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "slug": "dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation", "url": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/" }, "title": "Remove query shapes that prevent Resource Graph continuation", "summary": "A missing continuation token can reflect a query's operators or output types, not a complete inventory.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:10+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 236, "potentially_affected": "Azure Resource Graph queries intended to enumerate large resource inventories.", "dse_recommendation": "Review query operators, scalar output fields and truncation indicators before accepting an inventory export as complete.", "primary_source": { "name": "Work with large data sets - Azure Resource Graph | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Resource Graph normally returns at most 1,000 records per request. Microsoft documents that a query containing limit or sample/take will not return a continuation token. The same restriction applies when every output column has dynamic or null type.

\n

The response exposes count and totalRecords for returned and matching records. Microsoft also says that limit or take causes the skip control to be ignored, and that unsorted skipped results are not repeatable. Microsoft Learn.

\n

Applicability

\n

Use this check for a query meant to enumerate a population, not one deliberately designed to return a sample. Identify the requested scope and intended complete result before changing its operators.

\n

DSE recommendation

\n

DSE recommends removing intentional sampling from an inventory query and retaining a suitable scalar identifier in its output. Review truncation information and matching counts alongside the returned rows. Keep the exact query and scope with the export. Do not rename a sampled or nonpageable response as a full inventory merely because the request succeeded or no token appeared.

\n

Verification

\n

Test against a controlled population larger than one response page. Confirm that the revised query can retrieve the intended population and reconcile unique identifiers and counts. Test the original restricted query as a negative case so the collector recognizes the limitation. Investigate missing or repeated resources before using the result as an authoritative change list.

\n

Official references

\n

Microsoft Learn: Work with large data sets. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure Resource Graph normally returns at most 1,000 records per request. Microsoft documents that a query containing limit or sample/take will not return a continuation token. The same restriction applies when every output column has dynamic or null type.\nThe response exposes count and totalRecords for returned and matching records. Microsoft also says that limit or take causes the skip control to be ignored, and that unsorted skipped results are not repeatable. Microsoft Learn.\nApplicability\nUse this check for a query meant to enumerate a population, not one deliberately designed to return a sample. Identify the requested scope and intended complete result before changing its operators.\nDSE recommendation\nDSE recommends removing intentional sampling from an inventory query and retaining a suitable scalar identifier in its output. Review truncation information and matching counts alongside the returned rows. Keep the exact query and scope with the export. Do not rename a sampled or nonpageable response as a full inventory merely because the request succeeded or no token appeared.\nVerification\nTest against a controlled population larger than one response page. Confirm that the revised query can retrieve the intended population and reconcile unique identifiers and counts. Test the original restricted query as a negative case so the collector recognizes the limitation. Investigate missing or repeated resources before using the result as an authoritative change list.\nOfficial references\nMicrosoft Learn: Work with large data sets. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Resource Graph normally returns at most 1,000 records per request. Microsoft documents that a query containing limit or sample/take will not return a continuation token. The same restriction applies when every output column has dynamic or null type.\n\nThe response exposes count and totalRecords for returned and matching records. Microsoft also says that limit or take causes the skip control to be ignored, and that unsorted skipped results are not repeatable. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data).\n\n## Applicability\n\nUse this check for a query meant to enumerate a population, not one deliberately designed to return a sample. Identify the requested scope and intended complete result before changing its operators.\n\n## DSE recommendation\n\nDSE recommends removing intentional sampling from an inventory query and retaining a suitable scalar identifier in its output. Review truncation information and matching counts alongside the returned rows. Keep the exact query and scope with the export. Do not rename a sampled or nonpageable response as a full inventory merely because the request succeeded or no token appeared.\n\n## Verification\n\nTest against a controlled population larger than one response page. Confirm that the revised query can retrieve the intended population and reconcile unique identifiers and counts. Test the original restricted query as a negative case so the collector recognizes the limitation. Investigate missing or repeated resources before using the result as an authoritative change list.\n\n## Official references\n\n[Microsoft Learn: Work with large data sets](https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Remove query shapes that prevent Resource Graph continuation", "item": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/", "headline": "Remove query shapes that prevent Resource Graph continuation", "description": "A missing continuation token can reflect a query's operators or output types, not a complete inventory.", "abstract": "A missing continuation token can reflect a query's operators or output types, not a complete inventory.", "articleBody": "Source facts\nAzure Resource Graph normally returns at most 1,000 records per request. Microsoft documents that a query containing limit or sample/take will not return a continuation token. The same restriction applies when every output column has dynamic or null type.\nThe response exposes count and totalRecords for returned and matching records. Microsoft also says that limit or take causes the skip control to be ignored, and that unsorted skipped results are not repeatable. Microsoft Learn.\nApplicability\nUse this check for a query meant to enumerate a population, not one deliberately designed to return a sample. Identify the requested scope and intended complete result before changing its operators.\nDSE recommendation\nDSE recommends removing intentional sampling from an inventory query and retaining a suitable scalar identifier in its output. Review truncation information and matching counts alongside the returned rows. Keep the exact query and scope with the export. Do not rename a sampled or nonpageable response as a full inventory merely because the request succeeded or no token appeared.\nVerification\nTest against a controlled population larger than one response page. Confirm that the revised query can retrieve the intended population and reconcile unique identifiers and counts. Test the original restricted query as a negative case so the collector recognizes the limitation. Investigate missing or repeated resources before using the result as an authoritative change list.\nOfficial references\nMicrosoft Learn: Work with large data sets. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:10+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Remove query shapes that prevent Resource Graph continuation" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 236, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Work with large data sets - Azure Resource Graph | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data" } } ] } }