Dev/test VMs running 24/7 with auto-shutdown explicitly disabled
What does ZopNight detect here?
ZopNight flags a dev/test Azure VM whose auto-shutdown schedule is explicitly disabled, then sizes the saving as monthly cost times the measured off-hours idle fraction from 30 days of usage heatmaps. Without that measurement the rule abstains entirely: no flat 50% guess, no $0 advisory. Production-named or env=prod tagged VMs are never touched.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1302 |
| Category | schedule |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | vm_auto_shutdown.go |
Where it applies
How the rule decides a VM qualifies
Detection starts from naming and tags. A VM whose name matches production patterns, or that
carries an env=prod tag, is skipped outright; the VM must also match a dev/test naming pattern
to be considered at all. From there the rule reads the discoverer’s auto_shutdown_enabled
metadata key, which reflects whether a DevTest Labs shutdown schedule is attached to the VM.
Only an explicit "false" fires the rule. A customer tag of auto_shutdown=false is accepted
as a last-resort fallback, but only when the authoritative metadata key is absent. The rule
proves the schedule is missing rather than inferring it from silence.
Where the dollar figure comes from
Unlike most compliance-shaped findings, RC-1302 refuses to fire without a quantified saving. The aggregator builds a weekly usage heatmap for each VM and derives an idle fraction, the share of the week the machine sits unused. The saving is monthly cost multiplied by that measured fraction, and the recommendation ships with a concrete start/stop cron pair and timezone. An earlier version assumed a flat 50% of monthly cost; that estimate was removed because the real off-hours saving depends on the actual usage window, not a guess.
Four separate reasons it stays silent
The rule abstains when: the idle measurement is missing or non-positive; pricing for the VM is
unavailable or zero; neither metadata nor tag says auto-shutdown is off; or the VM has no
schedule or auto-shutdown tag at all. That last one is a hand-off: an untagged VM belongs
to the broader scheduling rule RC-213, so RC-1302 only covers VMs that rule already skipped.
A dev/test VM with no usage history correctly produces nothing.
Check a VM’s auto-shutdown schedule yourself
Auto-shutdown lives as a separate DevTest Labs schedule resource named after the VM:
az resource show \ --resource-group <rg> \ --name "shutdown-computevm-<vm-name>" \ --resource-type "microsoft.devtestlab/schedules" \ --query "properties.{status:status, time:dailyRecurrence.time, tz:timeZoneId}"A NotFound error means no schedule exists for that VM.
What ZopNight needs to see and to act
Discovery of the schedule state comes through the built-in Reader role; the usage heatmap behind the saving needs Monitoring Reader; per-VM cost needs Cost Management Reader. Applying the recommended window uses the Zopnight Write Access custom role, which deallocates the VM during off-hours. Deallocation, not power-off, because a stopped-but-allocated VM still bills.