How to write structured queries to connect to APIs and what are the best tools for a controlled enterprise environment?

Question

How to write structured queries to connect to APIs and what are the best tools for a controlled enterprise environment?

Anindya Kumar Banerjee 100

I need to download the entire "maker inventory" from Power Platform Admin center.

My colleague cannot see the inventory with Power Platform admin role, but I can see with Global Reader role. This should not be the case as per https://learn.microsoft.com/en-us/power-platform/admin/power-platform-inventory#access-requirements.

When I try to download the inventory, hovering the mouse over the download button says, "Download the items currently shown (up to 1000)".

However, I see several thousand items. So, I created a ticket with Microsoft for help with downloading all the items. They shared the following links:

https://learn.microsoft.com/en-us/rest/api/power-platform/

https://learn.microsoft.com/en-us/power-platform/admin/inventory-api

I understood I need to register an app. Grant delegated or application permissions. But then use a tool to pass those queries.

There are two challenges that I need help with:

I am relatively new to APIs. So, I need some guidance. I have some experience with Graph explorer.
Microsoft suggested that I write these queries in Postman. In an enterprise environment installing or using an unapproved app is difficult.

Based on the first line in the second article, "The inventory API allows you to execute structured queries against Azure Resource Graph using a POST request with a query specification in the request body.", is it possible to run the queries in Azure Resource Graph? If not, what are my options? Are there any Microsoft developed tools like PowerShell which can be easily trusted by security teams and used for the task? Where can I find the information which org specific that needs to be passed in these queries?

0 comments

3 answers

Your answer

Answer 1

Hello @Anindya Kumar Banerjee ,

Thank you for your question.

Based on the documentation, both Global** Reader and Power Platform **Administrator roles should have visibility to all inventory resources. If a user with the Power Platform Administrator role cannot access the inventory while a Global Reader can, that behavior does not appear to align with the documented access requirements. [https://le...uirements.]

Regarding exporting the inventory, the Power Platform admin center UI is limited to the items currently loaded in the grid (up to 1,000 items). For larger inventories, Microsoft provides the Power** Platform Inventory **API, which supports pagination through Top, Skip, and SkipToken, allowing you to retrieve all records across multiple requests. [https://le...uirements.], [Power Plat...soft Learn | Learn.Microsoft.com]

For tooling, Postman is not required. Since the Inventory API is a REST API, you can use Microsoft-supported options such as:

PowerShell using Invoke-RestMethod or Invoke-WebRequest
Azure** Cloud **Shell, which provides PowerShell and Azure CLI in a Microsoft-managed environment
Other approved REST clients available within your organization

The Power Platform API documentation describes the authentication and API model used to access these endpoints. [Microsoft...soft Learn | Learn.Microsoft.com], [Power Plat...soft Learn | Learn.Microsoft.com]

Regarding Azure Resource Graph, the documentation states that Power Platform inventory can be queried programmatically through Azure Resource Graph. The Inventory API itself accepts a structured query specification and translates it into KQL for execution against Azure Resource Graph. However, I could not find documentation indicating that the Inventory API request body can be submitted directly to Azure Resource Graph Explorer without modification. [https://le...uirements.], [Power Plat...soft Learn | Learn.Microsoft.com]

The organization-specific information required for authentication, such as the Tenant ID, Client ID, and permissions, comes from your Microsoft Entra app registration. Tenant context is generally inferred from the OAuth token used to authenticate to the Power Platform API. [Microsoft...soft Learn | Learn.Microsoft.com]

References

Power Platform Inventory
Inventory API
Power Platform API Please "upvote" if the information helped you. This will help us and others in the community as well.

Answer 2

Welcome to Microsoft Q&A

Hello @Anindya Kumar Banerjee , I hope you are doing well.

Based on your scenario, there are two separate questions:

Why a user with the Power Platform Administrator role cannot see the Maker Inventory while a Global Reader can, despite the documented access requirements.

Which Microsoft-supported tools are best suited for querying the Inventory API in an enterprise environment.

For the second question, Azure Resource Graph cannot be used directly to execute Inventory API queries. Although the API uses an Azure Resource Graph query syntax, the requests must be sent to the Power Platform Inventory API endpoint, so Azure Resource Graph Explorer is not supported for this scenario.

For a controlled enterprise environment, Microsoft-native options are:

PowerShell using Invoke-RestMethod or Invoke-WebRequest together with Microsoft Entra ID authentication. This is typically the preferred option in enterprise environments since it does not require third-party tools.

Azure Cloud Shell, which provides PowerShell and Azure CLI in a Microsoft-managed environment without requiring local software installation.

Visual Studio Code with the Microsoft PowerShell extension, if it is an approved development tool within your organization.

The organization-specific information required by the API, such as the Tenant ID, Application (Client) ID, and authentication details, comes from your Microsoft Entra app registration. The Inventory API documentation includes the required permissions and request format for obtaining an access token and executing queries.

Regarding the permissions discrepancy, if a Power Platform Administrator cannot access the Maker Inventory while a Global Reader can, and all documented prerequisites have been met, that behavior does not appear to match the published documentation and may indicate a permission propagation problem.

References

Power Platform Inventory API: https://learn.microsoft.com/power-platform/admin/inventory-api

Power Platform REST APIs: https://learn.microsoft.com/rest/api/power-platform/

Maker Inventory access requirements: https://learn.microsoft.com/power-platform/admin/power-platform-inventory#access-requirements

Azure Cloud Shell: https://learn.microsoft.com/azure/cloud-shell/overview

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.

Answer 3

Yes. There are two supported ways to query the Power Platform inventory programmatically:

Power Platform API
- The inventory API accepts a POST to:
```
     POST {PowerPlatformAPI url}/resourcequery/resources/query?api-version=2024-10-01
```
- The request body must contain a structured query specification with:
  - TableName
  - Clauses
  - optional Options such as Top, Skip, and SkipToken
- The target table is PowerPlatformResources.
Azure Resource Graph (ARG)
- Power Platform inventory data is also queryable through Azure Resource Graph.
- The sample queries run directly against the PowerPlatformResources table in ARG.
- This is the simplest option for learning and validating queries because the examples are already written in KQL.

For a controlled enterprise environment, the Microsoft-aligned options in the context are:

Azure Resource Graph interfaces
- Azure portal
- Azure CLI
- Azure PowerShell
- REST API
Power Automate using the Power Platform for Admins V2 connector
PowerShell through Azure Resource Graph interfaces

If Postman is difficult to approve, Azure portal, Azure CLI, or Azure PowerShell are the best alternatives called out in the documentation.

A practical path is:

Start in Azure Resource Graph

Use the sample KQL queries against PowerPlatformResources to confirm the data needed.

Example to count all resources:

     PowerPlatformResources
     | count

Example to count by environment:

     PowerPlatformResources
     | extend properties = parse_json(properties)
     | extend environmentId = tostring(properties.environmentId)
     | summarize resourceCount = count() by environmentId
     | order by resourceCount desc

Move to the Inventory API only if structured API access is required
- The inventory API translates the structured request body into Kusto Query Language for execution against Azure Resource Graph.
- This is useful when automation requires a REST POST body rather than writing raw KQL.
Use pagination for full export
- The UI download is limited to the items currently shown, up to 1000.
- The API supports pagination through Options and the response includes skipToken.
- Response fields include:
  - totalRecords
  - count
  - resultTruncated
  - skipToken
  - data
- For several thousand items, repeated calls using skipToken are the supported pattern.

About org-specific values to pass:

The main required table name is PowerPlatformResources.
Environment-specific filtering uses fields in properties, for example:
- properties.environmentId
- properties.createdAt
- properties.displayName
- properties.ownerId
The schema reference lists supported resource types, including:
- microsoft.powerplatform/environments
- microsoft.powerapps/canvasapps
- microsoft.powerautomate/cloudflows
- microsoft.copilotstudio/agents
To discover values in the tenant, start with ARG queries that inspect fields and then use those values in filters.

Examples from the documentation:

Find a specific Copilot Studio agent:

  PowerPlatformResources
  | where type == "microsoft.copilotstudio/agents"
  | where name == "[Enter the agent's ID]"

Filter canvas apps by environment and date range:

  PowerPlatformResources
  | where type == 'microsoft.powerapps/canvasapps'
  | where properties.environmentId == "your-environment-id"
  | extend createdDate = todatetime(properties.createdAt)
  | where createdDate >= datetime(2024-01-01)
  | project name, properties.displayName, properties.createdAt, properties.createdBy, properties.ownerId
  | sort by createdDate desc

If the goal is the entire maker inventory, the most enterprise-friendly approach from the available documentation is:

prototype the query in Azure Resource Graph
run it from Azure portal, Azure CLI, or Azure PowerShell
if a REST workflow is required, use the Power Platform inventory API with pagination via skipToken

The context does not provide the access-role troubleshooting steps for why Global Reader can see inventory while a Power Platform admin cannot, so only the supported querying options can be confirmed here.

References: