SQL Database or elastic pool without Azure Hybrid Benefit
A vCore SQL database or elastic pool paying the licence-included rate, which a customer holding SQL Server licences with Software Assurance can lower without downtime.
Why it happens
A vCore SQL database or elastic pool includes a SQL Server licence in its Azure price unless the customer applies one of their own. Microsoft states that Azure Hybrid Benefit saves up to 30 percent or more and that enabling it requires no downtime. Eligibility is narrower here than for a managed instance: the benefit applies only to the provisioned compute tier of the vCore purchasing model, so DTU databases and serverless databases are excluded, and Microsoft's rights table names only General Purpose and Business Critical, so Hyperscale is excluded too. A pooled database is skipped because its elastic pool carries the licence and the compute. Whether the customer holds Software Assurance is recorded in their licensing agreements and cannot be seen from inside Azure, so the rate being paid is reported and no saving is claimed.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type in~ ('microsoft.sql/servers/databases', 'microsoft.sql/servers/elasticpools')
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where tostring(properties.licenseType) =~ 'LicenseIncluded'
| extend isPool = type =~ 'microsoft.sql/servers/elasticpools'
// A pooled database does not pay the licence, the pool does, so only the pool is reported.
| where isPool or isempty(tostring(properties.elasticPoolId))
| where tostring(sku.tier) in~ ('GeneralPurpose', 'BusinessCritical')
| project name, resourceGroup,
scope = iff(isPool, 'pool', 'single'),
tier = tostring(sku.tier),
sku = tostring(sku.name)Elastic pools are listed alongside single databases because the check scans both. The note used to say pooled databases are excluded because the pool carries the licence, while the query never listed a single pool, so the thing paying the licence was the one thing missing. Only General Purpose and Business Critical are named in Microsoft's rights table, so DTU tiers, serverless and Hyperscale are excluded here on purpose.
Applies to microsoft.sql/servers/databasesWhat the agent does about it
A vCore SQL database or elastic pool paying the licence-included rate, which a customer holding SQL Server licences with Software Assurance can lower without downtime.
It will not fix this one
It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.
Related checks
Serverless SQL database with auto-pause switched off and nothing using it
A General Purpose serverless SQL database with auto-pause disabled that had no sessions and no CPU at any point in the window, so it billed its minimum compute floor around the clock for doing nothing.
Zone redundancy on a non-production SQL database
A SQL database or elastic pool with zone redundancy switched on in a non-production environment, paying a separate per-vCore meter for an availability guarantee nobody there is going to invoke.
SQL Business Critical on a non-production workload
A SQL database or elastic pool on Business Critical (or Premium DTU) tagged non-production.