Log Analytics Workspace Cost & Usage Analyzer

Introduction

If you're managing Azure environments at scale, you know the problem: Log Analytics Workspaces multiply like rabbits. Teams create them for projects, proof-of-concepts get forgotten, and before you know it, you have hundreds of workspaces across dozens of subscriptions with zero visibility into what's actually being used.

Workspace cost analysis with month-over-month breakdown and usage correlation

Microsoft gives you Log Analytics Workspaces but provides zero tools to answer the most basic questions: Which workspaces are actually being used? How much is each one costing? Can we consolidate or delete any of them?

The Workspace Sprawl Problem

In large Azure environments, workspace sprawl creates two critical issues:

Problem #1: Zero Visibility

You can't answer basic questions about your Log Analytics infrastructure:

• How many workspaces do we actually have across all subscriptions?
• Which workspaces are actively ingesting data vs. sitting idle?
• Who owns each workspace and what's its purpose?
• Which workspaces haven't been queried in months?

Problem #2: Hidden Cost Waste

Without visibility, costs spiral out of control:

• Forgotten workspaces continue ingesting data with nobody monitoring them
• Retention costs accumulate on data that's never queried
• Duplicate workspaces exist for the same purpose across different teams
• Scale multiplier effect: Hundreds of workspaces × daily ingestion × retention days = significant waste

The Azure portal shows individual workspace costs, but try correlating that with actual usage across 300+ workspaces spread across 50 subscriptions. You need Cost Management API data combined with KQL usage queries to identify the waste.

Solution Overview

This PowerShell solution solves the workspace sprawl problem by collecting two distinct but complementary metrics:

Cost Data (Cost Management API)

Retrieves historical monthly spend per workspace with daily cost breakdowns:

• Up to 60 months of historical cost data per workspace
• Month-over-month cost trends and average daily spend
• Server-side filtering to minimize API calls and processing time
• Automatic retry logic with exponential backoff for API throttling

Usage Data (KQL Queries)

Queries actual data ingestion volumes to show workspace activity:

• Total data ingested (GB) per workspace per month
• Billable vs. free data breakdown
• Last 30 days usage for quick health checks
• Shows which workspaces have costs without recent data ingestion

Key Features

Handles Large Environments

Built for organizations with hundreds of workspaces across multiple subscriptions. The solution handles API throttling, processes workspaces in batches, and can resume after interruptions without starting over.

Flexible Analysis Modes

Run cost analysis only, usage analysis only, or both together depending on what you need:

• Historical cost trends without touching workspaces
• Quick usage health checks
• Full cost-to-usage correlation for deletion decisions

Excel-Ready Reports

CSV output designed for Excel analysis with normalized data format. Filter by subscription, sort by cost, create pivot tables, and identify waste patterns immediately.

Subscription Scoping

Target specific subscriptions or scan your entire tenant. Process one subscription for focused analysis or get complete visibility across all subscriptions.

What You'll Get

📜 Ready-to-Run PowerShell Solution

• PowerShell scripts that discover all workspaces and collect cost + usage data
• Handles API throttling, large workspace counts, and interruptions automatically
• Works across all subscriptions or targets specific ones

📊 Cost & Usage Reports

• CSV report with workspace inventory, monthly costs, and usage data
• Month-over-month cost breakdown for trend analysis
• Data ingestion volumes to identify active vs. idle workspaces
• Excel-ready format for filtering, sorting, and pivot tables

📖 Setup & Analysis Guide

• Setup instructions for running the scripts
• Report analysis guidance to identify waste
• Decision framework for workspace consolidation

Requirements

You need Azure subscriptions with Log Analytics Workspaces, PowerShell 7+, and read access to cost data. Basic PowerShell and Excel skills are sufficient to run the scripts and analyze the reports.

The solution works with any Azure environment that has Log Analytics Workspaces - whether you have 10 workspaces or 500.

Implementation Scope

Run the PowerShell scripts to collect workspace data across your Azure environment. The scripts handle the discovery, cost collection, and usage queries automatically. You get a CSV report that shows which workspaces are costing money and which ones are actually being used.

For large environments with hundreds of workspaces, the initial run takes time due to API limits. The solution handles interruptions and can resume where it left off. Run it monthly to track workspace costs and identify new waste.

Use Cases

Cost Optimization Projects

Identify and eliminate workspace sprawl waste:

• Find workspaces with high costs but zero data ingestion
• Identify duplicate workspaces serving the same purpose
• Discover forgotten test/dev workspaces with ongoing costs
• Justify workspace consolidation with concrete cost data

Financial Reporting

Generate detailed cost reports for stakeholders:

• Monthly workspace cost trends for budget planning
• Cost allocation by subscription or resource group
• Usage-to-cost correlation for optimization decisions
• Historical spending analysis for showback/chargeback

Governance & Cleanup

Establish workspace management processes:

• Monthly workspace inventory and health checks
• Identify orphaned workspaces for ownership verification
• Track workspace creation patterns to prevent future sprawl
• Implement workspace lifecycle management based on data