Edit

Share via

graph function (preview)

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer

Note

This feature is currently in public preview. Functionality and syntax are subject to change before General Availability.

The graph function is an intrinsic function that enables querying of a persisted graph entity, similar to the cluster(), database(), external_table(), and table() functions. It supports retrieving either the most recent snapshot of the graph, a specific snapshot, or creating a transient graph from the model.

Permissions

To run this function, the user needs Database viewer permissions.

Syntax

graph( GraphName )

graph( GraphName , SnapshotName )

graph( GraphName , snapshot= SnapshotName )

graph( GraphName , Transient )

Parameters

Name Type Required Description
GraphName string ✔️ The name of the graph model to query.
SnapshotName string The name of a specific snapshot to retrieve. If not specified, the most recent snapshot is used.
Transient bool If true, creates a transient graph from the model (no snapshot is used). If false, uses the latest snapshot (same as omitting this parameter).

Returns

The graph function returns a graph and must be followed by a graph operator. The function retrieves the specified graph model name, either as:

  • The latest snapshot (default or when false is specified)
  • A specific named snapshot
  • A transient graph from the model (when true is specified)

Examples

Query the latest snapshot

The following example queries the most recent snapshot of a persisted graph named "SecurityGraph":

graph("SecurityGraph")
| graph-match (user)-[permission]->(resource)
  where user.type == "User" and resource.type == "Database"
  project UserName = user.name, ResourceName = resource.name, Permission = permission.type

Query a specific snapshot

The following example queries a specific snapshot of the graph:

graph("SecurityGraph", "Snapshot_2025_05_01")
| graph-match (attacker)-[attacks]->(target)-[connects]->(system)
  where attacker.name == "MaliciousActor"
  project Attacker = attacker.name, Target = target.name, System = system.name

Query with named parameter syntax

The following example uses the named parameter syntax to specify a snapshot:

graph("SecurityGraph", snapshot="Snapshot_2025_05_01")
| graph-shortest-paths (start)-[e*1..20]->(end)
  where start.name == "Alice" and end.name == "Database"
  project PathLength = array_length(e), Path = e

Create a transient graph from the model

The following example creates a transient graph from the model, similar to the make-graph operator:

graph("SecurityGraph", true)
| graph-match (user)-[permission]->(resource)
  where user.type == "User" and resource.type == "Database"
  project UserName = user.name, ResourceName = resource.name, Permission = permission.type

Use false to specify latest snapshot

The following example explicitly specifies false to use the latest snapshot, which is equivalent to omitting the second parameter:

graph("SecurityGraph", false)
| graph-match (user)-[permission]->(resource)
  where user.type == "User" and resource.type == "Database"
  project UserName = user.name, ResourceName = resource.name, Permission = permission.type

Related content