Zone-redundant Managed Grafana outside production

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.dashboard/grafana'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
// zoneRedundancy is an enum of Disabled and Enabled that DEFAULTS to Disabled, so an absent value
// means off rather than unknown. Matched exactly, so a value Azure adds later is not swept in.
| extend zoneRedundancy = tostring(properties.zoneRedundancy)
| where zoneRedundancy =~ 'Enabled'
// Deliberately no dollar arithmetic. The rate is read live by the agent so it cannot go stale here.
| project name, resourceGroup, location, zoneRedundancy, sku = tostring(sku.name), environment = cfopEnv

Azure Managed Grafana bills zone redundancy as its own meter rather than as a multiplier on the workspace, so it is a separable line on the bill. Verified against the retail API, East US publishes exactly four meters for Azure Grafana Service, and Standard Zone Redundancy is $0.0411 an hour, which is $30.00 over 730 hours. The Standard Node it protects is $0.0342 an hour, so the redundancy costs more than the thing it makes redundant. This query deliberately returns the setting rather than a dollar figure: a rate baked into a published query goes stale the day Azure reprices, which is why the agent reads it live. Note the remedy is NOT a setting change. The ARM specification lists zoneRedundancy among the properties a PATCH accepts, but Microsoft's documentation states you can enable zone redundancy only when you create the workspace and cannot change it later, so moving off it means deploying a new workspace and pointing the dashboards and data sources at it. This is a structural test, so what it returns is what the check reports.