NAT gateway scope property

Question

NAT gateway scope property

Justin Pinnix 0

Hello,

We are noticing that the graph API is returning an extra property on one of our NAT gateway resources that is not there when we query it using the resource manager APIs.

Specifically, this command:

az graph query -q "Resources | where type == 'microsoft.network/natgateways' and subscriptionId=='d6fa90ff-14f0-4f29-b9a7-05d981c8a356'"

includes the "scope": "Public", entry inside of the "properties" collection. However,

az network nat gateway show --name natGateway1 --resource-group AzureVirtualMachinesEnvironment --subscription d6fa90ff-14f0-4f29-b9a7-05d981c8a356

Does not include this in its version of properties.

I cannot find any mention of the scope property here: https://learn.microsoft.com/en-us/rest/api/virtualnetwork/nat-gateways/get?view=rest-virtualnetwork-2024-05-01&tabs=HTTP#natgateway

Can someone enlighten me as to why these results are different?

Thanks,

-JP

Anonymous

2025-08-21T17:10:31.3766667+00:00

Hello Justin Pinnix

I wanted to follow up and check if you had the opportunity to review the information provided in our previous post.

Kindly let us know if the above helps or you need further assistance on this issue.
Anonymous

2025-08-22T18:05:18.0866667+00:00

Hello

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.

1 answer

Your answer

Anonymous

2025-08-21T17:10:31.3766667+00:00

Hello Justin Pinnix

I wanted to follow up and check if you had the opportunity to review the information provided in our previous post.

Kindly let us know if the above helps or you need further assistance on this issue.
Anonymous

2025-08-22T18:05:18.0866667+00:00

Hello

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.

Answer 1

Hello Justin Pinnix

We understood that you're encountering an inconsistency between the properties returned by the Azure Graph API and the Resource Manager API for your NAT gateway resource.

The scope "Public" property appears in the Azure Resource Graph output for NAT Gateways due to Resource Graph’s ability to include extended or computed properties that are not exposed by the Azure Resource Manager API. This discrepancy arises because Resource Graph aggregates and indexes resource data differently, often using overridden API versions or internal logic to support governance and compliance scenarios.

For authoritative and schema-compliant NAT Gateway properties, it's best to rely on the Azure Resource Manager API (e.g., via az network nat gateway show). Use Azure Resource Graph primarily for broad querying and exploration across subscriptions, keeping in mind that it may surface additional metadata do not present in the official resource definitions.

If further clarification is needed, consider contacting Microsoft Support or investigating the specific API version used by Resource Graph for the Microsoft.Network/natGateways resource type.

For more information, refer to: https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview

https://learn.microsoft.com/en-us/rest/api/resources/

I hope it helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.