Non-production backup vault on geo-redundant storage
A Recovery Services vault outside production whose backup storage is geo-redundant, which bills at twice the locally redundant rate for a cross-region guarantee non-production does not need.
Why it happens
Azure Backup storage bills per GB per month at a rate set by the vault redundancy, and geo-redundant is exactly twice locally redundant: $0.0448 against $0.0224 per GB per month in East US. A vault outside production is buying a regional disaster guarantee that non-production by definition does not need. This reports what the vault bills today and names the setting. It deliberately quotes no saving, because the vault bill mixes storage with a per-protected-instance fee that does not change with redundancy, and the split cannot be derived from what this agent collects. It also does not promise the change is available: Azure documents the storage type as locked once any machine is registered to the vault, and that state lives on a child resource Resource Graph does not index, so the agent cannot tell whether this particular vault can still be changed.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.recoveryservices/vaults'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend redundancy = tostring(properties.redundancySettings.standardTierStorageRedundancy)
| where redundancy =~ 'GeoRedundant'
| project name, resourceGroup, location, redundancy, environment = cfopEnvGeoRedundant is the only setting that buys cross-region durability, and it bills at roughly double the locally-redundant rate. The value lives at properties.redundancySettings.standardTierStorageRedundancy; an older vault carries no redundancySettings at all, and this query treats that absence as not geo-redundant, exactly as the check does. This is a structural test, so what it returns is what the check reports rather than a list of candidates.
Applies to microsoft.recoveryservices/vaultsWhat the agent does about it
A Recovery Services vault outside production whose backup storage is geo-redundant, which bills at twice the locally redundant rate for a cross-region guarantee non-production does not need.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Expired or orphaned snapshot
A snapshot past its retention window whose source disk no longer exists.
NetApp capacity pool larger than its volumes need
An Azure NetApp Files capacity pool provisioned well above the capacity its volumes have claimed, billing for tebibytes nothing can use.
Premium SSD paying to burst and never bursting
A Premium SSD with on-demand bursting switched on that has not burst once in the window, so the flat monthly enablement fee is buying a capability the workload never reaches for.