# Remove query shapes that prevent Resource Graph continuation

> A missing continuation token can reflect a query's operators or output types, not a complete inventory.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:10+00:00
- Modified: 2026-09-10T01:23:49+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A missing continuation token can reflect a query's operators or output types, not a complete inventory.

## Potentially affected

Azure Resource Graph queries intended to enumerate large resource inventories.

## DSE recommendation

Review query operators, scalar output fields and truncation indicators before accepting an inventory export as complete.

## Article

## Source facts

Azure Resource Graph normally returns at most 1,000 records per request. Microsoft documents that a query containing limit or sample/take will not return a continuation token. The same restriction applies when every output column has dynamic or null type.

The response exposes count and totalRecords for returned and matching records. Microsoft also says that limit or take causes the skip control to be ignored, and that unsorted skipped results are not repeatable. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data).

## Applicability

Use this check for a query meant to enumerate a population, not one deliberately designed to return a sample. Identify the requested scope and intended complete result before changing its operators.

## DSE recommendation

DSE recommends removing intentional sampling from an inventory query and retaining a suitable scalar identifier in its output. Review truncation information and matching counts alongside the returned rows. Keep the exact query and scope with the export. Do not rename a sampled or nonpageable response as a full inventory merely because the request succeeded or no token appeared.

## Verification

Test against a controlled population larger than one response page. Confirm that the revised query can retrieve the intended population and reconcile unique identifiers and counts. Test the original restricted query as a negative case so the collector recognizes the limitation. Investigate missing or repeated resources before using the result as an authoritative change list.

## Official references

[Microsoft Learn: Work with large data sets](https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data). Source retrieved September 9, 2026.

## Primary reference

- Name: Work with large data sets - Azure Resource Graph | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/resource-graph/concepts/work-with-data
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Remove query shapes that prevent Resource Graph continuation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-286-remove-query-shapes-that-prevent-resource-graph-continuation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.