Log Analytics workspace retained beyond the free period
A Log Analytics workspace whose default retention exceeds the 31 days Azure includes at no extra cost. Every table without its own override inherits this, so it is reported once against the workspace rather than once per table.
Why it happens
Analytics Logs include 31 days of retention at no extra cost; beyond that, retention is billed per GB of retained data, daily. Workspace retention is typically set once at creation and never revisited, and it silently applies to every table that has no override. This reports the setting and the evidence for it. It does not price it: the cost depends on retained volume per table, which needs a data-plane query against the workspace Usage stream, a permission class this agent does not hold.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.operationalinsights/workspaces'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend retentionDays = toint(properties.retentionInDays)
| where isnotnull(retentionDays)
| where retentionDays > 90
| project name, resourceGroup, location, retentionDays, environment = cfopEnvTwo numbers matter and only one binds. Azure includes 31 days of Analytics Logs retention at no extra cost, and the rule's own threshold is 90 days, so 90 is the filter and anything between 32 and 90 is retained beyond the free allowance by deliberate policy. A workspace with no retentionInDays is skipped rather than assumed, because assuming a default would be inventing the very setting this reports. Every table without its own override inherits the workspace value, which is why it is reported once here instead of once per table.
Applies to microsoft.operationalinsights/workspacesWhat the agent does about it
A Log Analytics workspace whose default retention exceeds the 31 days Azure includes at no extra cost. Every table without its own override inherits this, so it is reported once against the workspace rather than once per table.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Log Analytics table over-retained beyond the configured baseline
A Log Analytics table whose interactive retention exceeds the configured baseline. The query-rate half of the intake row, which would tell whether the table is a Basic-plan candidate, needs a data-plane query the agent does not yet perform.
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.
Oversized virtual machine
A running VM whose sustained peak fits comfortably inside the next size down.