Premium SSD paying to burst and never bursting
A Premium SSD with on-demand bursting switched on that has not burst once in the window, so the flat monthly enablement fee is buying a capability the workload never reaches for.
Why it happens
On-demand bursting on a Premium SSD carries a flat monthly enablement fee that is charged for the capability rather than for using it, and the bursting itself is billed separately per transaction. A disk that bursts is paying for something it uses. A disk that has not burst once is paying the fee for nothing. The rule reports a Premium SSD larger than 512 GiB with the flag set whose burst operations metric stayed at zero for the whole window, and reports nothing where that metric was not collected, because a disk the agent could not read has not been shown to be quiet. Only Premium SSDs above 512 GiB are considered, because Microsoft states the feature cannot be enabled below that size and is supported on no other disk type, so a flag on anything else is not being billed. The saving is the enablement meter for the disk redundancy, read from the disk own SKU rather than assumed, and it is what the customer stops paying rather than an estimate. Two things travel with every finding: switching it off is possible only twelve hours after it was switched on, which Microsoft states, and a workload that bursts rarely rather than never will show as never over a short window, so the window length is part of the claim.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.compute/disks'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend skuName = tostring(sku.name)
// Microsoft supports on-demand bursting on Premium SSD only, and only above 512 GiB, so a
// flag on anything else is not being billed and is not worth reporting.
| where skuName in~ ('Premium_LRS', 'Premium_ZRS')
| where toint(properties.diskSizeGB) > 512
// An ABSENT flag is not an enabled one. Every disk that has never had bursting switched on
// reports no property at all, so the coalesce is what stops that reading as true.
| where tobool(coalesce(properties.burstingEnabled, false)) == true
| project name, resourceGroup, location, skuName,
sizeGb = toint(properties.diskSizeGB),
attachedTo = tostring(split(tostring(managedBy), '/')[-1])
| order by name ascEach row is a Premium SSD with on-demand bursting switched on. That flag carries a flat monthly enablement fee charged for the CAPABILITY rather than for using it, and the bursting itself is billed separately per transaction, so this list is what you are paying the fee on. Resource Graph holds no metrics, so this cannot apply the part that decides. The agent additionally requires the DiskPaidBurstIOPS metric to have stayed at zero across the whole window, and reports nothing where that metric was not collected, because a disk it could not read has not been shown to be quiet. So a row here is a candidate, not a finding. The two filters above it are Microsoft's own constraints rather than choices: bursting is supported on Premium SSD and no other disk type, and cannot be enabled below 512 GiB, so a flag anywhere else is not being billed. Two things travel with every finding and are worth knowing before you act: bursting can only be switched off twelve hours after it was switched on, and a workload that bursts rarely rather than never will look like never over a short window, so the window length is part of the claim.
Applies to microsoft.compute/disksWhat the agent does about it
A Premium SSD with on-demand bursting switched on that has not burst once in the window, so the flat monthly enablement fee is buying a capability the workload never reaches for.
It will not fix this one
It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.
Related checks
Disk IOPS above what the attached VM can deliver
A Premium disk provisioned for IOPS the attached VM size cannot use, so the customer pays for throughput they physically cannot reach.
Premium disk on a VM that has been off all window
A Premium SSD attached to a virtual machine that has been deallocated for the whole window, so it bills for performance nothing is using.
Premium SSD v1 disk that would be cheaper on v2
A Premium SSD v1 disk where a Premium SSD v2 of the same performance costs less.