SQL Server VM paying the Azure licence rate
A SQL Server virtual machine on a Standard or Enterprise edition with its licence set to pay-as-you-go, which Azure Hybrid Benefit would replace if the customer holds Software Assurance.
Why it happens
A SQL Server virtual machine bills the SQL Server licence separately from the machine it runs on, and a licence type of pay-as-you-go means that charge is being paid to Azure. Azure Hybrid Benefit replaces it for a customer who already holds Software Assurance or a subscription licence, and Microsoft describes the switch as unusually safe: it incurs no downtime, does not restart the virtual machine or the SQL Server service, adds no cost, and takes effect immediately. The rule reads the SQL virtual machine record rather than the machine underneath it, and it reads a different field from the equivalent checks on managed instances and databases, because this resource spells the licence differently and uses entirely different values for it. Only Standard and Enterprise editions are reported, because Microsoft supports the change on those alone: Developer and Express are free and have no licence charge to save, and Web is a paid edition that cannot be switched at all, so a rule built around the free editions would still have reported it wrongly. A licence type of DR is the free high availability replica and is left alone for the same reason. No saving is estimated, because the licence is metered per virtual core band and the core count is not on this resource: it lives on the machine as a size name that would have to be translated separately, and a figure assembled from a guess about that would be the only number a customer acts on. Two things this cannot see are stated on every finding: whether the customer actually holds Software Assurance, which Azure does not record, and whether the subscription uses centrally managed Azure Hybrid Benefit, in which case the value on this record may not be what is billed.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.sqlvirtualmachine/sqlvirtualmachines'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend sqlLicence = tostring(properties.sqlServerLicenseType)
| extend edition = tostring(properties.sqlImageSku)
| where sqlLicence =~ 'PAYG'
| where tolower(edition) in ('standard', 'enterprise')
| project name, resourceGroup, location, sqlLicence, edition, environment = cfopEnvRead properties.sqlServerLicenseType and NOT the virtual machine's licenseType. They are different properties with different values: a Microsoft.Compute VM carries licenseType with BasePrice or LicenseIncluded, while a SQL virtual machine resource carries sqlServerLicenseType with PAYG, AHUB or DR. A query copied from the VM rule finds nothing on every estate, silently. PAYG is the only one paying: AHUB already has the benefit and DR is the free high-availability replica. The edition filter is an allowlist of Standard and Enterprise, the editions Microsoft permits changing the licence model on, so an edition Azure adds later is silent rather than wrongly reported.
Applies to microsoft.sqlvirtualmachine/sqlvirtualmachinesWhat the agent does about it
A SQL Server virtual machine on a Standard or Enterprise edition with its licence set to pay-as-you-go, which Azure Hybrid Benefit would replace if the customer holds Software Assurance.
It will not fix this one
It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.
Related checks
HDInsight worker nodes without autoscale
A Spark, Hadoop or Interactive Query cluster whose worker role has no autoscale configured, so it pays for peak worker capacity every hour of every day.
SQL Managed Instance without Azure Hybrid Benefit
A SQL Managed Instance paying the licence-included rate, which a customer holding SQL Server licences with Software Assurance can lower without downtime.
Serverless SQL database with auto-pause switched off and nothing using it
A General Purpose serverless SQL database with auto-pause disabled that had no sessions and no CPU at any point in the window, so it billed its minimum compute floor around the clock for doing nothing.