Verify Resource Graph candidates against the provider before irreversible actions

Source facts

Azure Resource Graph indexes control-plane data asynchronously and can lag behind the owning resource provider. Microsoft recommends a hybrid approach for critical decisions: discover at scale through Resource Graph, then verify current state with the provider immediately before irreversible action.

A query immediately after creation can report not found even though the resource exists. The guidance advises provider fallback for this case and warns against verifying through the provider on every ordinary poll, which defeats the scaling benefit and can trigger throttling. Microsoft Learn.

Applicability

Identify the selection query, intended action and provider operation that establishes the necessary current state. Distinguish a stale negative result from confirmed absence.

DSE recommendation

DSE recommends separating candidate discovery from action authorization in the workflow. Immediately before an irreversible step, recheck the exact resource and decision-relevant properties through the provider. Stop if the state differs from the approved conditions or cannot be established. Do not reinterpret a failed freshness check as permission to delete, recreate or restart the resource.

Verification

In a nonproduction test, introduce an authorized resource-state change between selection and execution. Confirm that the final check detects the difference and stops the proposed action. Test the recently created-resource case separately. Retain both observations and their times so the automation’s decision can be explained without presenting the indexed result as a guaranteed current snapshot.

Official references

Microsoft Learn: Choose the right query strategy for Azure Resource Graph. Source retrieved September 9, 2026.