Production Azure VMs placed in neither an availability set nor an availability zone
What does ZopNight detect here?
ZopNight flags a production Azure VM that belongs to neither an availability set nor an availability zone. Microsoft's 99.95% VM SLA for availability sets applies only to two or more VMs in the set, and a VM's availability set cannot be changed after creation, so fixing a finding means recreating the VM. No saving is claimed.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1306 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Threshold | no availability set and no zone |
| Source | ZopNight |
| Permissions used | Microsoft.Compute/virtualMachines/read |
Where it applies
A lone VM has no redundancy of its own
Availability sets spread VMs across fault domains, which share power and network switches, and update domains, which Azure restarts one at a time during planned maintenance. An availability set can have up to 3 fault domains and 20 update domains. Availability zones go further, placing VMs in physically separate datacenters within a region.
A VM in neither has no placement guarantee relative to anything. Microsoft ties its 99.95% SLA to two or more VMs in an availability set; a single VM outside one does not get that commitment.
Listing VMs without placement
az vm list \ --query "[?availabilitySet==null && zones==null].{name:name, rg:resourceGroup}" \ -o tableFilter the output to production workloads; the same query returns dev and test VMs too.
Gates the VM must pass
- The VM is classified as production: its name contains
prod,production,prdorlive(and does not look like dev or test), or anenv,environment,stageortiertag says so. - It is not an instance of a Uniform orchestration scale set; those already get fault-domain and zone spread from the scale set.
- Azure reports no availability set and no zone for the VM.
Cases that do not fire, and one that might
Non-production VMs are not evaluated. If ZopNight could not determine the VM’s placement, it raises nothing. One known gap remains: members of Flexible orchestration scale sets look like standalone VMs today, so a regional Flexible member can be flagged even though the scale set handles its distribution. Dismiss those with that reason.
Downtime risk, not a bill
There is no saving attached, and availability sets themselves cost nothing extra; you pay only for the VMs. The risk is a production service going down with its only host during hardware failure or maintenance.
Rebuilding with redundancy
Microsoft states that a VM can be added to an availability set only when it is created, so the fix is a rebuild.
- Decide between zones, for datacenter-level isolation, and an availability set, for lower VM-to-VM latency.
- Set the VM’s disks to detach rather than delete on VM deletion.
- Delete the VM and recreate it from the same disks in the chosen set or zone.
- Add at least a second VM behind a load balancer; one VM in a set gains little.
- For fleets, consider a Virtual Machine Scale Set, which distributes instances automatically.