Provisioned throughput sitting idle on Azure OpenAI

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.cognitiveservices/accounts'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| project account = name, resourceGroup, location,
          acctKind = tostring(kind),
          sku = tostring(sku.name)

Resource Graph does not index microsoft.cognitiveservices/accounts/deployments, so this lists the accounts and the deployments inside them have to come from ARM: az cognitiveservices account deployment list -g <rg> -n <account>. Deliberately not filtered to kind OpenAI, because Azure AI Foundry accounts have kind AIServices and host model deployments too. A deployment on a Provisioned or ProvisionedManaged SKU bills its committed capacity by the hour whether or not a token is sent. The check decides on the AzureOpenAIProvisionedManagedUtilizationV2 metric, keeping deployments that averaged under 40 percent of purchased capacity across the previous 336 hours. It deliberately does not use the per-deployment token counts: reading ProcessedPromptTokens or GeneratedTokens per deployment needs a ModelDeploymentName dimension filter the metric collector does not send yet, so those totals are reported as null rather than as a subscription-wide figure that would not describe the deployment.