Windows VM paying the Azure licence rate
A Windows virtual machine with no licence type set, so its hourly rate includes a Windows Server licence that Azure Hybrid Benefit would remove if the customer holds Software Assurance.
Why it happens
A Windows virtual machine bills a higher hourly rate than the same machine running Linux, and the difference is the Windows Server licence. Azure Hybrid Benefit removes it for a customer who already holds licences with Software Assurance or a qualifying subscription, moving the machine to the base compute rate, which Microsoft states is equal to the Linux rate. The rule reports a machine whose licence type is missing or set to None. Absence is read as paying, which is the one part of this check Azure does not state as a rule: what it publishes is a discovery command that matches only the positive value and revert examples that set None explicitly, and the finding says so rather than presenting that reading as documented. Only Windows machines are reported, because Linux uses a different programme that swaps an operating system subscription rather than waiving a licence, and every machine in a Linux estate would otherwise be flagged for a benefit that cannot apply. Machines already marked for the client benefit are left alone, because that qualifies through per-user Microsoft 365 or virtual desktop entitlement rather than through the core licences this is about. Unlike the three database checks in this family, the saving here is a real figure rather than an unpriced state, because Azure publishes both prices for the same machine: the Windows and Linux meters differ only in their product name, so the licence cost is the difference between them, computed per size and per region rather than as a percentage Microsoft does not publish. Two things this cannot see are on every finding: whether the customer holds the licences, which Azure never records, and whether they hold enough of them, since the benefit requires a minimum of eight core licences per machine however small it is. Applying it changes a metadata flag only and does not restart the machine or interrupt service. Reserved instances and savings plans neither help nor interfere, because they cover compute and not the licence.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.compute/virtualmachines'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where tostring(properties.storageProfile.osDisk.osType) =~ 'Windows'
| extend licenceType = tostring(properties.licenseType)
| where isempty(licenceType) or licenceType =~ 'None'
| project name, resourceGroup, location,
vmSize = tostring(properties.hardwareProfile.vmSize),
licenceTypeThe osType line is the one to keep. Resource Graph returns an empty string rather than null for a machine that has never had a licence type set, so isempty covers both that and an explicit None, and without the Windows filter the query returns every Linux machine in the estate for a benefit that cannot apply to any of them. Run against the reference subscription it returns nothing, and the same query without the osType line returns all three of its Linux VMs. Machines already set to Windows_Server are excluded because they are on the benefit, and Windows_Client is excluded because it qualifies through per-user Microsoft 365 or VDA entitlement rather than the core licences this is about. Whether the licences are held, and whether there are the eight core minimum per machine, is not in Azure and the query cannot tell you.
Applies to microsoft.compute/virtualmachinesWhat the agent does about it
A Windows virtual machine with no licence type set, so its hourly rate includes a Windows Server licence that Azure Hybrid Benefit would remove if the customer holds Software Assurance.
It will not fix this one
It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.
Related checks
Idle virtual machine
A running VM whose CPU and network have been near zero for the whole window.
Oversized virtual machine
A running VM whose sustained peak fits comfortably inside the next size down.
VM on an older series version
A VM running a v3 or v4 series where the same size on v5 costs the same or less.