azure-kusto Skill for Claude: Query Azure Data Explorer With KQL

Makes Claude explore Azure Data Explorer clusters and run KQL queries on logs, telemetry and time series data.

Installs: 572.5K; on skills.sh
Stars: 1.6K; on GitHub
Updated: Oct 2026; last repo commit

azure-kusto lets Claude find your Azure Data Explorer clusters and databases, read table schemas and run KQL queries. It carries query patterns for basic retrieval, aggregation, time series, joins and schema discovery. It also searches several candidate clusters or workspaces before it says a table does not exist.

Claude uses the Azure MCP Kusto tools first. If they time out or fail, it falls back to Azure CLI commands and az rest against the cluster. Queries read your data, so pick the database with care.

Good for

Data and SRE teams querying Azure Data Explorer
Engineers analyzing telemetry, logs or IoT time series
Anyone who needs help writing KQL

Install azure-kusto

Claude Code

Copy this prompt.

Install the azure-kusto skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Azure CLI signed in.

Pick one route, not both. The plugin installs all the Azure skills and wires in the Azure and Foundry tool servers they call. The skills CLI route installs only the skills named in the command, and does not wire in the Azure or Foundry tool servers, so enable the Azure MCP server separately if you want the tools the skills call. Sign in with az login first.

From the project README. Source.

What's in the skill

When it loads

Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clusters, log analytics, time series data, IoT telemetry, anomaly detection.

Sections in SKILL.md

Overview
Core Workflow
Query Patterns
Pattern 1: Basic Data Retrieval
Pattern 2: Aggregation Analysis
Pattern 3: Time Series Analytics
Pattern 4: Join and Correlation
Pattern 5: Schema Discovery
Pattern 6: Batch Search Across Candidate Sources
Key Data Fields
Result Format
KQL Best Practices
Best Practices
MCP Tools Used
Fallback Strategy: Azure CLI Commands
CLI Command Reference

Key facts

Author: Microsoft
License: MIT (stated in SKILL.md)
GitHub stars: 1,609 for the whole microsoft/azure-skills repo (Nov 2, 2026)
Last commit: Oct 30, 2026
What installs: SKILL.md only; bundles no other files
Needs: Azure MCP Kusto tools or the Azure CLI; Viewer role on the database at minimum
Part of: The azure plugin in microsoft/azure-skills
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk warn
Works in: GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, OpenCode (plugin README)

What it includes

Lists Data Explorer clusters in a subscription
Network · kusto_cluster_list
Lists databases in a cluster
Network · kusto_database_list
Gets the schema of a table before querying
Network · kusto_table_schema_get
Runs a KQL query against a database
Used for retrieval, aggregation, time series and joins.
Network · kusto_query
Checks many clusters or workspaces for a table
Used when the table location is unknown, so an empty result is not mistaken for a missing table.
Network · Batch search across sources
az kusto commands and az rest when MCP fails
Switches over on timeouts, service errors or auth failures.
Runs code · Azure CLI fallback

From the official docs

Permissions

Medium risk

Claude reads data from your Data Explorer databases and the results enter the chat. Avoid databases holding personal or secret data, and approve any raw REST fallback.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Query results go into the chat
Claude reads what your queries return. Avoid databases with personal or secret data unless that is allowed.
It can fall back to raw REST calls
On MCP failure it may use az rest against the cluster URL. Approve those commands individually.
skills.sh audit: Snyk warn
Gen Agent Trust Hub and Socket pass; Snyk is listed as warn. Read the audit on skills.sh before installing.

Technical details

Scopes	Reads data in the clusters and databases you can access Runs KQL queries through Azure MCP or az rest Uses your Azure sign-in

Questions

What does azure-kusto do?

It lets Claude discover Azure Data Explorer clusters and databases, read schemas and run KQL queries. It also helps write and tune KQL.

How do I install it?

Use the install box at the top of this page. In Claude Code the plugin command installs the Azure skills together with the Azure tools they call, so pick it unless you want this one skill only. Run az login before you start.

Can it change or delete data?

The SKILL.md describes queries, schema lookups and listing only. Your own role decides what is possible.

What permissions do I need?

The SKILL.md names Viewer on the database as the minimum for queries.

Is it safe?

It reads your data and sends results into the chat. skills.sh shows Gen Agent Trust Hub and Socket as pass and Snyk as warn.

What if the MCP tool times out?

The skill falls back to Azure CLI commands, including a REST query with az rest, for timeouts, connection errors and auth failures.

Does it work in the Claude app, Codex or Cursor?

The Azure README lists GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI and OpenCode as hosts for the plugin. It does not list the Claude desktop or web app.

Information

updated Nov 2, 2026

Repository: microsoft/azure-skills
Folder: skills/azure-kusto

microsoft/azure-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

microsoft/azure-skills README · github.com
azure-kusto SKILL.md · github.com
azure-kusto on skills.sh · skills.sh