Premium disk on a VM that has been off all window

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.compute/virtualmachines'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where tostring(properties.extended.instanceView.powerState.code) =~ 'PowerState/deallocated'
| project vmId = tolower(id), vm = name
| join kind=inner (
    resources
    | where type =~ 'microsoft.compute/disks'
    | where sku.name has 'Premium'
    | project disk = name, resourceGroup,
              sizeGb = toint(properties.diskSizeGB),
              sku = tostring(sku.name),
              vmId = tolower(tostring(managedBy))
) on vmId
| project disk, resourceGroup, sku, sizeGb, attachedTo = vm

managedBy is a top-level Resource Graph column, not a field inside properties. The power state only appears when the virtual machines row carries properties.extended.instanceView, which Resource Graph fills in. A deallocated machine bills nothing for compute while its Premium disk bills in full, but check the machine is not simply switched off overnight on a schedule before moving it to Standard SSD. Resource Graph shows the current power state and nothing about how long it has held, so the query cannot apply the rest of the check: it requires the machine to have published no datapoints for the Percentage CPU metric across the previous 336 hours, which is how a machine that has been off for two weeks is told apart from one deallocated a minute ago.