Geo-redundant storage account outside production
A storage account replicated to a second region. Geo-redundancy roughly doubles the per-GB storage rate against locally redundant storage, and read-access variants cost more again.
Why it happens
Redundancy is usually chosen once when an account is created and never revisited, and the portal's default is not the cheapest option. Geo-replication protects against a regional disaster, which is a guarantee non-production does not need. Microsoft states redundancy can be changed on an existing account, though some configurations carry limitations and downtime, so this reports the setting and proposes nothing. It carries no dollar figure: a storage bill is capacity plus transactions plus egress, and only the capacity portion changes with redundancy, so applying a published per-GB ratio to the whole bill would produce a number the customer could not reconcile against their invoice.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.storage/storageaccounts'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where tostring(sku.name) in~ ('Standard_GRS', 'Standard_RAGRS', 'Standard_GZRS', 'Standard_RAGZRS')
| project account = name, resourceGroup, location,
sku = tostring(sku.name),
environment = tostring(tags['Environment'])These four SKUs replicate to a second region and cost more than their single-region equivalents: Standard_GRS and Standard_RAGRS drop to Standard_LRS, Standard_GZRS and Standard_RAGZRS to Standard_ZRS. The RA variants cost more again for readable secondary access. Redundancy is a durability decision, so treat this as a list to review rather than a list to change.
Applies to microsoft.storage/storageaccountsWhat the agent does about it
A storage account replicated to a second region. Geo-redundancy roughly doubles the per-GB storage rate against locally redundant storage, and read-access variants cost more again.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Hot-tier blob data that nothing has touched
Blob data held in the Hot access tier on an account that recorded no transactions at all over the window, where the Cool tier would bill less for the same bytes.
Storage account with SFTP enabled but no SFTP activity
A storage account with `properties.isSftpEnabled == true` that recorded no transactions of any kind in the evaluation window, so its hourly SFTP charge is buying nothing.
Expired or orphaned snapshot
A snapshot past its retention window whose source disk no longer exists.