Filtering Resources
In a tenant with hundreds or thousands of resources, filters get you to what you care about. Click Add Filters in the Explorer header to open the Filter Resources dialog. Filter by name, type, location, tags, or to just resources with direct RBAC assignments.
On This Page
Resource Filters
The top section of the dialog filters by resource attributes — name, type, and location. All three are optional and combine as an intersection.
- Resource Name
- Substring match against resource names. Case-insensitive.
- Resource Type
- Searchable multi-select. Pick one or more Azure types, e.g.,
Microsoft.Compute/virtualMachines. Type-ahead supported. - Location
- Multi-select of Azure regions. Pick any combination.
Tag Filters
Click Add Tag Filter to add a row. Each row has three parts: a tag key dropdown, an operator, and a value (only shown when needed).
- =
- Exact match against the chosen value. Value dropdown is required.
- exists
- Resource has this tag, regardless of value.
- missing
- Resource does NOT have this tag.
Use missing to find tagging gaps
missing is how you find resources that should have a tag but don't — for example, every resource without a cost-center tag, or production resources without an owner. Pair it with a resource-type or location filter to scope a tagging-hygiene sweep to the area you care about.
Note
The tag value dropdown is populated from values present in the loaded snapshot. You can't type a value that doesn't exist in the data.
Combining tag rules: AND vs OR
When two or more tag rows exist, an AND/OR toggle appears in the tag filter section header.
Tip
Use AND when a resource must match every rule — for example, env=prod AND team=payments. Use OR for a union — for example, owner=alice OR owner=bob.
RBAC Filter
In the bottom Other Filters section, check Show only resources with RBAC assignments to narrow the view to resources that have role assignments defined directly on them. The number to the right of the checkbox shows how many resources qualify in the current snapshot.
Note
This filter shows resources with direct role assignments only. Resources that inherit RBAC from their resource group or subscription are not shown — even though those inherited roles are still in effect.
How Filters Combine
When multiple filter types are active, they are applied in order: resource attribute filters first, then tag filters, then the RBAC filter. The final result is the intersection of all three.
While any filter is active, organizational entities (subscriptions and resource groups) only appear if they are parents of matching resources, or if they themselves match a tag filter. Filtering down to "eastus" therefore hides subscriptions and resource groups that have no matching children.
Active filter chips
The Explorer header shows compact chips next to the filter button when filters are active: N resources for resource attribute filters, N tags for tag filters, and RBAC when the RBAC filter is on. Click Clear next to the filter button to remove every active filter without opening the dialog.
Defaults & Persistence
- Default state
- No filters applied. The header button reads Add Filters with no chips.
- Snapshot switching
- Switching snapshots clears all filters. Tag values and resource types are scan-specific, so previous selections may not even exist in another snapshot.
- URL state
- The RBAC filter is encoded in the URL, so it survives a refresh and is shareable. Resource attribute filters and tag filters are not encoded — they reset on navigation away.
Troubleshooting
My filters disappeared after I switched snapshots
Answer
Switching snapshots clears filters by design. Re-apply them after switching, or use the Change Tracking feature to compare two snapshots side-by-side without flipping the picker.
I expected the RBAC filter to include inherited roles
Answer
It only shows direct assignments. To audit who has effective access at a resource group or subscription, click into that scope in Explorer and use its RBAC button to see the assignments defined at that level.