Resource Graph error 500 An unexpected query execution error occurred

[red-erik]

Hello,
the query itself is working but we receive this:

FTL Failed to run Resource Graph query:
SecurityResources
| where type == 'microsoft.security/assessments'
| where properties.status.code == 'Unhealthy'
| mvexpand Category = properties.metadata.categories
| extend
AssessmentId = id,
AssessmentKey = name,
ResourceId = tostring(properties.resourceDetails.Id),
ResourceIdsplit = split(properties.resourceDetails.Id, '/'),
RecommendationName = tostring(properties.displayName),
RecommendationState = tostring(properties.status.code),
ActionDescription = tostring(properties.metadata.description),
RemediationDescription = tostring(properties.metadata.remediationDescription),
RecommendationSeverity = tostring(properties.metadata.severity),
PolicyDefinitionId = properties.metadata.policyDefinitionId,
AssessmentType = properties.metadata.assessmentType,
Threats = properties.metadata.threats,
UserImpact = properties.metadata.userImpact,
AzPortalLink = tostring(properties.links.azurePortal),
CategoryString = tostring(Category)
| extend
ResourceSubId = tostring(ResourceIdsplit[2]),
ResourceGroupName = tostring(ResourceIdsplit[4]),
ResourceType = tostring(ResourceIdsplit[6]),
ResourceName = tostring(ResourceIdsplit[8])
| join kind=leftouter (resourcecontainers
| where type == 'microsoft.resources/subscriptions'
| project SubscriptionName = name, subscriptionId) on subscriptionId
| project SubscriptionId=subscriptionId, SubscriptionName, ResourceGroupName, ResourceType,
ResourceName, Category=CategoryString, RecommendationSeverity, RecommendationName, ActionDescription,
RemediationDescription, AzPortalLink, ResourceId
| distinct SubscriptionId, SubscriptionName, ResourceGroupName, ResourceType, ResourceName, Category, RecommendationSeverity, RecommendationName, ActionDescription, RemediationDescription, AzPortalLink, ResourceId
error="HTTP 500 from https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2024-04-01: {"error":{"code":"InternalServerError","message":"Please provide below info when asking for support: timestamp = 2026-01-12T12:36:27.6750458Z, correlationId = 7d1be2c2-43a3-4b78-9af6-003047a939ab.","details":[{"code":"UnexpectedQueryExecutionError","message":"An unexpected query execution error occurred. Please try again later."}]}}"

Regards,
Red.

[cmendible]

Hmm that's a 500 coming form the API so very probably it's caused by a transient error on Azure side. You can disable defender scan with th e --defender=false flag

[red-erik]

Hello,
same results today but I did not disabled Defender scan. I'll try that later but I really need it.

2026-01-14T12:31:19+01:00 FTL Failed to run Resource Graph query:
SecurityResources
| where type == 'microsoft.security/assessments'
| where properties.status.code == 'Unhealthy'
| mvexpand Category = properties.metadata.categories
| extend
AssessmentId = id,
AssessmentKey = name,
ResourceId = tostring(properties.resourceDetails.Id),
ResourceIdsplit = split(properties.resourceDetails.Id, '/'),
RecommendationName = tostring(properties.displayName),
RecommendationState = tostring(properties.status.code),
ActionDescription = tostring(properties.metadata.description),
RemediationDescription = tostring(properties.metadata.remediationDescription),
RecommendationSeverity = tostring(properties.metadata.severity),
PolicyDefinitionId = properties.metadata.policyDefinitionId,
AssessmentType = properties.metadata.assessmentType,
Threats = properties.metadata.threats,
UserImpact = properties.metadata.userImpact,
AzPortalLink = tostring(properties.links.azurePortal),
CategoryString = tostring(Category)
| extend
ResourceSubId = tostring(ResourceIdsplit[2]),
ResourceGroupName = tostring(ResourceIdsplit[4]),
ResourceType = tostring(ResourceIdsplit[6]),
ResourceName = tostring(ResourceIdsplit[8])
| join kind=leftouter (resourcecontainers
| where type == 'microsoft.resources/subscriptions'
| project SubscriptionName = name, subscriptionId) on subscriptionId
| project SubscriptionId=subscriptionId, SubscriptionName, ResourceGroupName, ResourceType,
ResourceName, Category=CategoryString, RecommendationSeverity, RecommendationName, ActionDescription,
RemediationDescription, AzPortalLink, ResourceId
| distinct SubscriptionId, SubscriptionName, ResourceGroupName, ResourceType, ResourceName, Category, RecommendationSeverity, RecommendationName, ActionDescription, RemediationDescription, AzPortalLink, ResourceId
error="HTTP 500 from https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2024-04-01: {"error":{"code":"InternalServerError","message":"Please provide below info when asking for support: timestamp = 2026-01-14T11:31:19.3370316Z, correlationId = 39d63344-d9a6-4890-b80b-31179880706c.","details":[{"code":"UnexpectedQueryExecutionError","message":"An unexpected query execution error occurred. Please try again later."}]}}"

Regards,
Red.

[cmendible]

Issue seems to be generated by the left join with resourcecontainers in some environments. We are testing a fix

[cmendible]

Version v2.16.1 includes a fix. While digging into this, I realized that this query can return hundreds of thousands of rows in large environments, so it’s a good idea to narrow the scan down to a specific set of management groups or subscriptions.