Non-production VMs running out of hours
Test servers running nights and weekends
Why it happens
Nobody works those hours but the meter does. A machine only needed in office hours bills for roughly three times what it is used.
A development machine that runs nights and weekends bills for roughly three times the hours anyone actually uses it. Nobody remembers to stop them on Friday.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.compute/virtualmachines'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend power = tostring(properties.extended.instanceView.powerState.code)
| where power == 'PowerState/running'
| project name, resourceGroup, env = cfopEnv, size = tostring(properties.hardwareProfile.vmSize)Run this outside working hours. Anything it returns is billing for time nobody is using.
Applies to microsoft.compute/virtualmachinesWhat the agent does about it
Non-production compute left running outside working hours.
And what stops it
It has to see the same thing on three consecutive runs before it will act, it stays away from anything a person changed recently, and it will not touch a resource unless you tagged it non-production. Untagged counts as production. Every refusal is written down with the rule that caused it.
Related checks
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.
Oversized virtual machine
A running VM whose sustained peak fits comfortably inside the next size down.
VM on an older series version
A VM running a v3 or v4 series where the same size on v5 costs the same or less.