# Azure Hybrid Benefit Opportunity

> Azure Hybrid Benefit strips the Windows Server license component from a VM's rate, up to 40% of compute cost. ZopNight flags VMs whose osType is windows and whose license_type shows no existing entitlement, pricing the saving as the measured Windows-to-Linux rate gap times 730 hours, never a flat percentage.

Source: https://zop.dev/integrations/azure/recommendations/azure-hybrid-benefit-opportunity
Updated: 2026-08-19

---

## The license premium hiding in every Windows VM rate

A Windows VM's hourly price bundles two things: the compute and a Windows Server license
rental. Organizations that already own licenses with Software Assurance can wave the rental,
which is Azure Hybrid Benefit, yet fleets migrated by lift-and-shift routinely leave it
unclaimed on every VM. The rule reads the discoverer's normalized OS metadata: only VMs whose
osType is windows are candidates.

## Skipping VMs that already claimed it

Azure reports an applied entitlement through the VM's license_type property: Windows_Server,
Windows_Client, or AHB. ZopNight checks that field across both tags and metadata,
case-insensitively, and skips any VM already carrying an entitlement; re-recommending an
enabled discount is noise. Power state matters too: a deallocated pay-as-you-go VM pays no
license and is skipped, but a deallocated VM under a Reservation or Savings Plan still pays
the license inside its commitment, so it stays eligible.

## The 40% ceiling as a sanity check

The saving is the aggregator's measured Windows-versus-Linux rate gap for the exact SKU,
multiplied over a 730-hour month. Hybrid Benefit tops out around 40% of a Windows VM's
compute cost, so a computed delta exceeding that ceiling relative to the VM's billed cost
signals mismatched data (usually a rack-rate delta against an RI-discounted bill), and the
rule abstains rather than print it. No measured delta, no finding.

## Find unclaimed VMs in one query

```bash
az vm list --query \
  "[?storageProfile.osDisk.osType=='Windows' && licenseType==null].{name:name, size:hardwareProfile.vmSize}" \
  -o table
```

## Enabling it is a checkbox, eligibility is not

The portal toggle sits under the VM's Configuration blade and applies without downtime. The
real work is license accounting: each 16-core license set covers a defined core count, and
claiming the benefit without eligible licenses under Software Assurance is a compliance
violation your next audit will find. Confirm entitlement with whoever owns the agreement
before flipping fleets.

## Verification inputs

Reader covers OS and license metadata; Cost Management Reader covers the billed cost the
ceiling test runs against. CPU and memory series appear as evidence of a live workload but
never gate the finding.