Cognitive Services accounts with no API calls and no token usage
What does ZopNight detect here?
Paid-tier Cognitive Services accounts keep billing without traffic, so ZopNight watches TotalCalls and TokenTransaction over 30 days and flags an account only when the call average is 0 and neither series shows a single peak above 0. Bursty nightly callers are deliberately spared.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1378 |
| Category | idle |
| Severity | low |
| Metric | none — pure configuration read |
| Source | cognitive_idle.go |
Where it applies
Token spikes hide inside a flat average
A Cognitive Services account that serves one large batch job a night can average close to zero
calls across a month while doing real work. That is why this rule refuses to fire on the
average alone: if the trusted peak on either TotalCalls or TokenTransaction is above 0,
there was usage, and a delete recommendation would target a live account. Both the call series
and the token series must be silent on average and on maximum before the account is flagged.
The 30-day evidence window for AI accounts
The analysis window is 30 days, and the calls series must carry at least 7 days of trustworthy history before a zero is believed. A freshly created account, or one whose Monitor diagnostics were just wired, reads zero because there is no data, not because nobody needs it. Firing there would be a false positive, so the rule waits.
Detection is metric-only. There is no tag or label shortcut: a customer-authored tag can never gate an irreversible delete.
Checking an account from your terminal
az monitor metrics list \ --resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.CognitiveServices/accounts/<name>" \ --metric TotalCalls TokenTransaction \ --interval PT1H --offset 30d --aggregation Average MaximumLook for any non-zero hour across both metrics.
Silence conditions for this rule
ZopNight abstains when the calls series is absent, when its coverage is under 7 days, when any call or token activity registered anywhere in the window, or when the account has no positive priced cost. Free-tier (F0) accounts typically fail the cost gate and are ignored. There is nothing to save.
Downgrade is an option before delete
The portal path is Azure AI services (the tile that absorbed Cognitive Services) → Metrics. If the account is on S0 or higher and you want to keep the endpoint name and keys, downgrading to the free tier stops the charge while preserving the resource. If nothing references it, delete it. Flagging requires only Reader plus Monitoring Reader. ZopNight holds no write permission on Cognitive Services accounts.