Commitment tiers above the workspace daily cap
Paying for more log ingestion than your own limit allows
Why it happens
You committed to a daily amount of log data and also set a cap below it. The cap stops the data, and the commitment bills anyway.
A commitment tier bills every day whether the data arrives or not, and a daily cap stops the data arriving. A workspace capped below what it committed to cannot use what it is paying for.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.operationalinsights/workspaces'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
// Only a commitment tier can be over-committed. Every other sku bills what is used.
| where tostring(properties.sku.name) =~ 'CapacityReservation'
// A workspace in a dedicated cluster is billed at the CLUSTER, so the per-workspace
// arithmetic below does not describe it.
| where isempty(tostring(properties.features.clusterResourceId))
| extend committedGbPerDay = toint(properties.sku.capacityReservationLevel)
// -1 is Azure's "no cap". Treating it as a cap of minus one gigabyte would make every
// uncapped workspace look infinitely over-committed.
| extend dailyCapGb = toint(properties.workspaceCapping.dailyQuotaGb)
| where committedGbPerDay > 0 and dailyCapGb > 0
| where dailyCapGb < committedGbPerDay
| extend unusableGbPerDay = committedGbPerDay - dailyCapGb
| project name, resourceGroup, location, committedGbPerDay, dailyCapGb, unusableGbPerDay
| order by unusableGbPerDay descThis query finds the workspaces where the cap sits below the commitment; it does NOT decide whether moving is worth it, and the agent does. The commitment is cheaper per gigabyte than pay-as-you-go, an effective $1.96 against $2.30 at the 100 GB tier, so a workspace capped at 90 GB would pay more on pay-as-you-go and is better off where it is. The agent reports only where the arithmetic favours moving, and the figure it quotes is a floor: the cap is the most that could be ingested, so it is the most pay-as-you-go could cost. Note also that a commitment tier cannot be left for 31 days from the day it was selected.
Applies to microsoft.operationalinsights/workspacesWhat the agent does about it
A workspace committed to more daily ingestion than its own daily cap permits it to ingest.
It will not fix this one
It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.
Related checks
Log Analytics workspace retained beyond the free period
A Log Analytics workspace whose default retention exceeds the 31 days Azure includes at no extra cost. Every table without its own override inherits this, so it is reported once against the workspace rather than once per table.
Log Analytics table over-retained beyond the configured baseline
A Log Analytics table whose interactive retention exceeds the configured baseline. The query-rate half of the intake row, which would tell whether the table is a Basic-plan candidate, needs a data-plane query the agent does not yet perform.
Zone-redundant Managed Grafana outside production
A Managed Grafana workspace paying for zone redundancy while tagged non-production.