# Azure Dev/Test VM Without Auto-Shutdown

> ZopNight flags a dev/test Azure VM whose auto-shutdown schedule is explicitly disabled, then sizes the saving as monthly cost times the measured off-hours idle fraction from 30 days of usage heatmaps. Without that measurement the rule abstains entirely: no flat 50% guess, no $0 advisory. Production-named or env=prod tagged VMs are never touched.

Source: https://zop.dev/integrations/azure/recommendations/azure-dev-test-vm-without-auto-shutdown
Updated: 2026-08-19

---

## How the rule decides a VM qualifies

Detection starts from naming and tags. A VM whose name matches production patterns, or that
carries an env=prod tag, is skipped outright; the VM must also match a dev/test naming pattern
to be considered at all. From there the rule reads the discoverer's `auto_shutdown_enabled`
metadata key, which reflects whether a DevTest Labs shutdown schedule is attached to the VM.
Only an explicit `"false"` fires the rule. A customer tag of `auto_shutdown=false` is accepted
as a last-resort fallback, but only when the authoritative metadata key is absent. The rule
proves the schedule is missing rather than inferring it from silence.

## Where the dollar figure comes from

Unlike most compliance-shaped findings, RC-1302 refuses to fire without a quantified saving.
The aggregator builds a weekly usage heatmap for each VM and derives an idle fraction, the
share of the week the machine sits unused. The saving is monthly cost multiplied by that
measured fraction, and the recommendation ships with a concrete start/stop cron pair and
timezone. An earlier version assumed a flat 50% of monthly cost; that estimate was removed
because the real off-hours saving depends on the actual usage window, not a guess.

## Four separate reasons it stays silent

The rule abstains when: the idle measurement is missing or non-positive; pricing for the VM is
unavailable or zero; neither metadata nor tag says auto-shutdown is off; or the VM has no
`schedule` or `auto-shutdown` tag at all. That last one is a hand-off: an untagged VM belongs
to the broader scheduling rule RC-213, so RC-1302 only covers VMs that rule already skipped.
A dev/test VM with no usage history correctly produces nothing.

## Check a VM's auto-shutdown schedule yourself

Auto-shutdown lives as a separate DevTest Labs schedule resource named after the VM:

```bash
az resource show \
  --resource-group <rg> \
  --name "shutdown-computevm-<vm-name>" \
  --resource-type "microsoft.devtestlab/schedules" \
  --query "properties.{status:status, time:dailyRecurrence.time, tz:timeZoneId}"
```

A NotFound error means no schedule exists for that VM.

## What ZopNight needs to see and to act

Discovery of the schedule state comes through the built-in Reader role; the usage heatmap
behind the saving needs Monitoring Reader; per-VM cost needs Cost Management Reader. Applying
the recommended window uses the Zopnight Write Access custom role, which deallocates the VM
during off-hours. Deallocation, not power-off, because a stopped-but-allocated VM still bills.