Log Analytics tables on the wrong plan and retention
Logs kept far longer than anyone looks at them
Why it happens
Log storage is priced per gigabyte and retention is usually set once and forgotten. Older logs can move to a cheaper tier or expire.
Analytics is the default plan and the most expensive per GB. Tables that are only ever queried during an incident often belong on Basic, and retention is frequently set far beyond anyone's actual need.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.operationalinsights/workspaces'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend retentionDays = toint(properties.retentionInDays)
| where retentionDays > 90
| project name, resourceGroup, location,
sku = tostring(properties.sku.name),
retentionDays
| order by retentionDays descResource Graph does not index microsoft.operationalinsights/workspaces/tables, which is what this check actually reads, so this lists the WORKSPACES and the per-table plans have to come from the tables API: az monitor log-analytics workspace table list -g <rg> --workspace-name <workspace>. Rows here are a starting point and not the check's findings: a workspace with long default retention is where over-retained tables tend to be, but the rule fires on a table, and a workspace can sit at the default while one table inside it is set to years. The ninety days is the rule's own retentionDaysThreshold rather than a number chosen for the query. Honest about verification: the reference subscription owns no Log Analytics workspaces, so this returns nothing there and its selection, including the threshold, is unproven on real data.
Applies to microsoft.operationalinsights/workspaces/tablesWhat the agent does about it
A Log Analytics table whose interactive retention exceeds the configured baseline. The query-rate half of the intake row, which would tell whether the table is a Basic-plan candidate, needs a data-plane query the agent does not yet perform.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Log Analytics workspace retained beyond the free period
A Log Analytics workspace whose default retention exceeds the 31 days Azure includes at no extra cost. Every table without its own override inherits this, so it is reported once against the workspace rather than once per table.
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.
Oversized virtual machine
A running VM whose sustained peak fits comfortably inside the next size down.