Billing surprises: find what costs money

1Cost by service, month to date

Ask Cost Management for this month’s cost grouped by service:

New-Item -ItemType Directory -Force C:\azure-lab\l73 | Out-Null
$sub = az account show --query id -o tsv
@{ type = 'ActualCost'; timeframe = 'MonthToDate'; dataset = @{ granularity = 'None'; aggregation = @{ totalCost = @{ name = 'Cost'; function = 'Sum' } }; grouping = @(@{ type = 'Dimension'; name = 'ServiceName' }) } } | ConvertTo-Json -Depth 10 | Set-Content C:\azure-lab\l73\cost-by-service.json
$r = az rest --method post --url "https://management.azure.com/subscriptions/$sub/providers/Microsoft.CostManagement/query?api-version=2023-03-01" --body '@C:\azure-lab\l73\cost-by-service.json' | ConvertFrom-Json
$r.properties.rows | Sort-Object { [double]$_[0] } -Descending | Select-Object -First 6 | ForEach-Object { '{0,-40} {1,10:N2} {2}' -f ($_[1] -split '/')[-1], [double]$_[0], $_[2] }

You should see your own list, something like this:

Virtual Machines                               0.62 USD
Virtual Network                                0.48 USD
Storage                                        0.21 USD
Log Analytics                                  0.09 USD
Bandwidth                                      0.01 USD

2Cost by resource

Change the grouping to see which resources cost the most:

@{ type = 'ActualCost'; timeframe = 'MonthToDate'; dataset = @{ granularity = 'None'; aggregation = @{ totalCost = @{ name = 'Cost'; function = 'Sum' } }; grouping = @(@{ type = 'Dimension'; name = 'ResourceId' }) } } | ConvertTo-Json -Depth 10 | Set-Content C:\azure-lab\l73\cost-by-resource.json
$r = az rest --method post --url "https://management.azure.com/subscriptions/$sub/providers/Microsoft.CostManagement/query?api-version=2023-03-01" --body '@C:\azure-lab\l73\cost-by-resource.json' | ConvertFrom-Json
$r.properties.rows | Sort-Object { [double]$_[0] } -Descending | Select-Object -First 6 | ForEach-Object { '{0,-40} {1,10:N2} {2}' -f ($_[1] -split '/')[-1], [double]$_[0], $_[2] }

You should see resource names with their cost, for example disks, public IPs and gateways from earlier lessons.

3Save the waste finder

Save this as C:\azure-lab\Find-AzureWaste.ps1. You’ll use it again in Lesson 74:

param([int]$SnapshotAgeDays = 30)
# SaatVedha Azure Lesson 73: list resources that cost money while doing nothing useful
$checks = [ordered]@{
    'VM stopped, not deallocated'   = "resources | where type =~ 'microsoft.compute/virtualmachines' | where tostring(properties.extended.instanceView.powerState.code) == 'PowerState/stopped' | project name, resourceGroup, detail = tostring(properties.hardwareProfile.vmSize)"
    'Disk of a deallocated VM'      = "resources | where type =~ 'microsoft.compute/disks' | where tostring(properties.diskState) == 'Reserved' | project name, resourceGroup, detail = strcat(tostring(sku.name), ' ', tostring(properties.diskSizeGB), ' GiB')"
    'Unattached disk'               = "resources | where type =~ 'microsoft.compute/disks' | where tostring(properties.diskState) == 'Unattached' | project name, resourceGroup, detail = strcat(tostring(sku.name), ' ', tostring(properties.diskSizeGB), ' GiB')"
    'Public IP not in use'          = "resources | where type =~ 'microsoft.network/publicipaddresses' | where isnull(properties.ipConfiguration) and isnull(properties.natGateway) | project name, resourceGroup, detail = tostring(sku.name)"
    'Hourly network service'        = "resources | where type in~ ('microsoft.network/azurefirewalls', 'microsoft.network/applicationgateways', 'microsoft.network/virtualnetworkgateways', 'microsoft.network/natgateways', 'microsoft.network/bastionhosts') | where not(type =~ 'microsoft.network/bastionhosts' and tostring(sku.name) == 'Developer') | project name, resourceGroup, detail = type"
    "Snapshot older than $SnapshotAgeDays days" = "resources | where type =~ 'microsoft.compute/snapshots' | where todatetime(properties.timeCreated) < ago(${SnapshotAgeDays}d) | project name, resourceGroup, detail = strcat(tostring(properties.diskSizeGB), ' GiB')"
}
$found = foreach ($c in $checks.GetEnumerator()) {
    $rows = (az graph query -q $c.Value --first 1000 -o json | ConvertFrom-Json).data
    foreach ($r in $rows) { [pscustomobject]@{ Finding = $c.Key; Name = $r.name; ResourceGroup = $r.resourceGroup; Detail = $r.detail } }
}
if ($found) { $found | Sort-Object Finding, Name | Format-Table -AutoSize } else { 'Nothing found.' }

Run it:

C:\azure-lab\Find-AzureWaste.ps1

You should see something like this:

Finding                   Name            ResourceGroup  Detail
-------                   ----            -------------  ----------------------
Disk of a deallocated VM  web01_OsDisk_1  RG-SAAT-VMS    StandardSSD_LRS 30 GiB
Disk of a deallocated VM  win01_OsDisk_1  RG-SAAT-VMS    StandardSSD_LRS 127 GiB

Your list depends on what you kept from earlier lessons. The parked web01 and win01 disks show up because deallocated VMs still pay for their disks.

✅ Checkpoint: You can see this month’s cost by service and by resource, and the waste finder lists what exists right now.