Purview account nobody scans with
A Microsoft Purview account whose Data Map billed all window while no scan of any outcome ran.
Why it happens
The Microsoft Purview Data Map bills per capacity unit per hour whether or not anything is scanned, at $0.411 an hour in eastus, which is about $300 a month per capacity unit and never stops. An account created to evaluate data governance and then left alone keeps paying for a catalogue nobody queries. The rule reports an account where no scan completed, failed or was cancelled across the whole window: all three outcomes count as use, because an account whose scans keep failing is being used and misconfigured rather than abandoned, and one whose scans were cancelled is being used by somebody who changed their mind. The saving is measured rather than assumed. DataMapCapacityUnits is sampled hourly and publishes only Total and Count, so its sum across the window is capacity-unit-hours, which is the unit the meter charges, and the monthly figure is that rate extrapolated. The scanning meter is deliberately not used: Standard vCore at $0.63 an hour is larger but already stops when nobody scans, so pricing an idle account from it would report a saving that is already zero. What this cannot see travels on every finding: an account scanned quarterly for a compliance report looks identical to an abandoned one over any shorter window, which is why this reports and a person decides. Deleting a Purview account destroys the data map, its classifications and its lineage, and none of that returns from a redeploy.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.purview/accounts'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| project name, resourceGroup, location, environment = cfopEnv,
friendlyName = tostring(properties.friendlyName)This query lists the accounts the check considers, and it is NOT the check. Resource Graph holds no metrics, so it cannot tell you which of these went unscanned. The rule decides on the total of ScanCompleted, ScanFailed and ScanCancelled across the window, counting all three because a failed scan is still use and so is a cancelled one. The saving is priced from the DataMapCapacityUnits metric, whose hourly samples sum to the capacity-unit-hours the Data Map meter charges for. Every account this query returns is a candidate, not a finding.
Applies to microsoft.purview/accountsWhat the agent does about it
A Microsoft Purview account whose Data Map billed all window while no scan of any outcome ran.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
HDInsight worker nodes without autoscale
A Spark, Hadoop or Interactive Query cluster whose worker role has no autoscale configured, so it pays for peak worker capacity every hour of every day.
SQL Managed Instance without Azure Hybrid Benefit
A SQL Managed Instance paying the licence-included rate, which a customer holding SQL Server licences with Software Assurance can lower without downtime.
Serverless SQL database with auto-pause switched off and nothing using it
A General Purpose serverless SQL database with auto-pause disabled that had no sessions and no CPU at any point in the window, so it billed its minimum compute floor around the clock for doing nothing.