Troubleshooting Additional Cost incurred over Failing Transactions

Question

Hi All,

Noticed that we have a very high cost on an Azure Storage account that is typically unused. Access to this Storage Account is via IP whitelisting

Storage Account Metrics

Based on the metrics it seems like there are some services that is trying to authenticate but is failing

Our investigation found a NSG Flow Logs with a failed provisioned status.

Actions taken:

1. Turned on Logging - didn't help as these failed transactions did not show up
2. Deleted NSG Flow Logs - Seemed to have helped but took quite awhile before it happened
3. Switched Storage Tier to Hot

We are still incurring $8 a day in costs despite not using the storage account. I would like to seek advice and get help on

1. Identifying the root cost of these failures so that we can resolve this
2. For the failed NSG flow Logs, is this something that Azure can help verify if it has contributed to the cost spike, and if so are we able to get credits for this

Answer 1

Hello Gerald Tan

Thank you for your question!

I understand that You're experiencing a persistent $8/day cost on an Azure Storage account that should be largely unused, with evidence pointing to failed authentication attempts and "failed provisioned" NSG Flow Logs. Let's get to the bottom of this.

Please be informed that Storage accounts incur costs for operations like read, write, list, and other API calls, even if they fail due to IP whitelisting or authentication issues. Failed authentication attempts (e.g., from unauthorized IPs) can still generate billable transactions.

• navigate to Cost Management > Cost Analysis for the storage account and break down costs by:
• Operation type (e.g., CreateBlockBlob, GetBlob, ListBlobs).
• API name to identify specific calls.
• Response type (e.g., ClientOtherError or AuthorizationError for failed requests).
• Look for spikes in transaction counts, especially for failed operations, as these may indicate repeated unauthorized access attempts.

If failed operations were somehow attempting data transfer that partially succeeded before failing, or if the failure itself involved some amount of data processing or networking, minimal egress charges could apply, but this is less likely to be the primary driver of $8/day on an unused account.

Verify Log Volume: In the storage account,

• navigate to Containers > insights-logs-networksecuritygroupflowevent and check the size of stored blobs. Large volumes of flow log data could explain the cost spike.
• NSG Flow Logs have a retention policy (default is 0, meaning indefinite storage). If logs were written before deletion, they may still reside in the account, incurring storage costs. Set a retention period (e.g., 30 days) or manually delete old logs to reduce costs.

Recommendations:

1. If data is rarely accessed, switch back to Cool or Archive tiers to reduce storage costs. Use Lifecycle Management policies to automatically transition old data to cheaper tiers.
2. Delete any residual flow log data in the insights-logs-networksecuritygroupflowevent container and set a short retention period to prevent future buildup.
3. Monitor Costs Daily: Use Cost Management > Budgets to set alerts for unexpected cost spikes and track progress after implementing changes.

References:

You may utilize the Pricing Calculator to determine the areas where costs are rising:

https://azure.microsoft.com/en-in/pricing/calculator/?msockid=2fc42ae332836ffe36b63f1b336b6e5a

Hope the above answer helps! Please let us know do you have any further queries.

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

Answer 2

Hi @Nandamuri Pranay Teja

Can you confirm that Cool Write Operations and Hot Write Operations costs can incur from Non-Whitelisted IP addresses attempts to authenticate?

If so, how will we be able to protect ourselves?

There is no data on the Storage account itself.