Skip to main content
compliance · azure

VM scale sets with no Azure Monitor autoscale setting, stuck at a fixed instance count

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags an Azure virtual machine scale set when no `microsoft.insights/autoscalesettings` resource targets it. Without one, the set runs whatever instance count was last set by hand, day and night, whatever the load. ZopNight suggests a starting policy that adds one instance when average `Percentage CPU` passes 70%.

Signal and threshold

How ZopNight evaluates VM scale sets with no Azure Monitor autoscale setting, stuck at a fixed instance count.
Field Value
Rule IDsRC-ASC-002
Categorycompliance
Severitymedium
Metricnone — pure configuration read
Thresholdno autoscale setting targets the scale set
SourceZopNight
Permissions usedMicrosoft.Compute/virtualMachineScaleSets/read · Microsoft.Insights/AutoscaleSettings/Read

What a scale set does without autoscale

A virtual machine scale set only changes size when something tells it to. Azure Monitor autoscale is the usual “something”: it adds resources when load rises and removes them when load falls, which Microsoft notes is what lowers your costs, always inside a minimum and maximum you set.

With no autoscale setting, the instance count is whatever someone last typed. Sized for peak, every quiet hour is paid for at peak. Sized for average, the first busy hour runs hot with nothing to add capacity. Either way the scale set is a fixed pool of VMs that happens to use scale-set tooling.

Finding scale sets that no autoscale setting targets

Each autoscale setting records the resource it controls in targetResourceUri. Compare that list with your scale sets:

Terminal window
az monitor autoscale list --query "[].targetResourceUri" -o tsv | tr 'A-Z' 'a-z' | sort > targets.txt
az vmss list --query "[].id" -o tsv | tr 'A-Z' 'a-z' | sort > vmss.txt
comm -13 targets.txt vmss.txt

Every ID printed by comm is a scale set with no autoscale setting. Both lists are lowercased first so a difference in letter case cannot hide a match.

How ZopNight decides a scale set has no setting

ZopNight looks up the autoscale settings in your subscriptions and joins them to each scale set by its resource ID. It raises the finding when:

  1. The scale set is provisioned successfully or running.
  2. The lookup ran and found no autoscale setting targeting that scale set.

There is no metric window or utilization threshold here; this is a configuration read made on every evaluation.

When ZopNight cannot tell, it says nothing

If the autoscale lookup was skipped, for example because the connected identity cannot read Microsoft.Insights/AutoscaleSettings, the result is unknown rather than “not configured”, and the scale set gets no finding. Scale sets that do have a setting move on to the tuning checks: Scaling Target Too High, Scaling Target Too Low and Scaling Cooldown Too Short.

Why no saving is attached

The finding carries no dollar amount. Working out what autoscale would save needs a record of how far the set could have scaled in, and a scale set that has never autoscaled has no such history. ZopNight therefore reports it as a configuration gap rather than inventing a figure. Once a setting exists, the scale-in history it produces is what the tuning checks above can reason about.

Adding an autoscale setting to the scale set

  1. Create the setting with instance limits that bound cost and protect availability: az monitor autoscale create --resource-group my-rg --resource my-vmss --resource-type Microsoft.Compute/virtualMachineScaleSets --name my-vmss-autoscale --min-count 2 --max-count 10 --count 2.
  2. Add a scale-out rule, for example az monitor autoscale rule create --resource-group my-rg --autoscale-name my-vmss-autoscale --condition "Percentage CPU > 70 avg 5m" --scale out 1.
  3. Add the matching scale-in rule on the same metric, for example --condition "Percentage CPU < 30 avg 5m" --scale in 1.
  4. Keep the minimum and maximum apart. Microsoft’s best practices point out that a setting with minimum and maximum both at 2 can never scale.
  5. Review scale actions in the activity log after the first busy and quiet periods.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·