Skip to main content
idle · azure

Cognitive Services accounts with no API calls and no token usage

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

Paid-tier Cognitive Services accounts keep billing without traffic, so ZopNight watches TotalCalls and TokenTransaction over 30 days and flags an account only when the call average is 0 and neither series shows a single peak above 0. Bursty nightly callers are deliberately spared.

Signal and threshold

How ZopNight evaluates Cognitive Services accounts with no API calls and no token usage.
Field Value
Rule IDsRC-1378
Categoryidle
Severitylow
Metricnone — pure configuration read
Sourcecognitive_idle.go

Token spikes hide inside a flat average

A Cognitive Services account that serves one large batch job a night can average close to zero calls across a month while doing real work. That is why this rule refuses to fire on the average alone: if the trusted peak on either TotalCalls or TokenTransaction is above 0, there was usage, and a delete recommendation would target a live account. Both the call series and the token series must be silent on average and on maximum before the account is flagged.

The 30-day evidence window for AI accounts

The analysis window is 30 days, and the calls series must carry at least 7 days of trustworthy history before a zero is believed. A freshly created account, or one whose Monitor diagnostics were just wired, reads zero because there is no data, not because nobody needs it. Firing there would be a false positive, so the rule waits.

Detection is metric-only. There is no tag or label shortcut: a customer-authored tag can never gate an irreversible delete.

Checking an account from your terminal

Terminal window
az monitor metrics list \
--resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.CognitiveServices/accounts/<name>" \
--metric TotalCalls TokenTransaction \
--interval PT1H --offset 30d --aggregation Average Maximum

Look for any non-zero hour across both metrics.

Silence conditions for this rule

ZopNight abstains when the calls series is absent, when its coverage is under 7 days, when any call or token activity registered anywhere in the window, or when the account has no positive priced cost. Free-tier (F0) accounts typically fail the cost gate and are ignored. There is nothing to save.

Downgrade is an option before delete

The portal path is Azure AI services (the tile that absorbed Cognitive Services) → Metrics. If the account is on S0 or higher and you want to keep the endpoint name and keys, downgrading to the free tier stops the charge while preserving the resource. If nothing references it, delete it. Flagging requires only Reader plus Monitoring Reader. ZopNight holds no write permission on Cognitive Services accounts.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·