Premium container registry on a non-production registry
A container registry on the Premium tier while tagged non-production.
Why it happens
A container registry bills its tier per day regardless of what it holds or how often anything pulls from it: about $5 a month on Basic, $20 on Standard and $50 on Premium. Premium buys geo-replication, private link, content trust and customer-managed keys, none of which a development or test registry exercises, so the tier is a fixed charge for guarantees it will never claim against. The saving quoted is the move to Standard rather than to Basic, because Basic caps storage at 10 GB and a registry holding real images would begin paying overage there.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.containerregistry/registries'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend tier = tostring(coalesce(sku.tier, sku.name))
| where tier =~ 'Premium'
| project name, resourceGroup, location, tier, environment = cfopEnvA registry bills its tier per day regardless of what it holds or how often anything is pulled: roughly $5 a month on Basic, $20 on Standard and $50 on Premium. For registries the tier and the sku name carry the same word, so this reads whichever is present. The saving the check quotes is the move to Standard rather than Basic, because Basic caps storage at 10 GB and a registry holding real images would start paying overage there. This is a structural test, so what it returns is what the check reports.
Applies to microsoft.containerregistry/registriesWhat the agent does about it
A container registry on the Premium tier while tagged non-production.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
AKS paid control plane on a non-production cluster
An AKS cluster on the Standard or Premium control plane tier while tagged non-production.
Container App holding replicas warm with no traffic
A Consumption-plan Container App with minReplicas above zero that served no HTTP requests in the window, so it paid idle charges to stay warm for traffic that never came.
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.