# FinOps for AI on Azure: Azure Best Practices Analyzer

> FinOps for AI is one of the 29 analyses in Azure Best Practices Analyzer (ABPA), a FinOps and best-practice assessment of an Azure environment, built by MILL5, that is deployed into the customer's own Azure tenant. The analysis is read-only. It finds unused and ungoverned Azure AI spend: provisioned throughput that is idle, over-provisioned or not reserved, search services with no traffic, machine learning and GPU compute that bills while idle, model deployments nothing calls, and AI resources with no tags or budget. Findings carry the ownership evidence that can be found, and an estimated monthly saving where one can be measured. MILL5, a Microsoft partner, can install it with the customer's administrators, walk the customer's teams through the findings and carry out the changes the customer approves.

Key facts:

- Services covered: Azure OpenAI and Microsoft Foundry accounts and their model deployments, Azure AI Search, Azure Machine Learning workspaces and compute, and GPU virtual machines.
- Method: model deployments, search services and GPU virtual machines are measured against 30 days of Azure Monitor metrics; machine learning clusters and compute instances are judged on how they are configured. It applies Microsoft's Cloud Adoption Framework and Well-Architected Framework guidance on the cost of AI workloads.
- The analysis is read-only. It uses the Reader role at the scope the customer chooses, optionally Reservations Reader for provisioned throughput reservations, and the Microsoft Graph permission Directory.Read.All to look up the people connected to a resource. The same identity also holds Monitoring Reader and Cost Management Reader for the other analyses. It does not call models or search indexes and does not list account keys, so it does not read prompts, completions or the documents in a search index.
- Installing is not read-only and needs an administrator. The main things the installer creates are a resource group that holds the application, a Microsoft Entra app registration, two managed identities with their role assignments, and an Azure Policy that protects the application's own tags. The resources run in the customer's subscription and are billed to it by Azure.
- The application runs in the customer's tenant. Findings are stored in Azure Table Storage in the customer's subscription.
- Savings figures are estimates for review, calculated from deployed capacity and Azure list prices. Four checks carry no figure: pay-per-token deployments with no traffic, prompt-cache hit rate, tags and budgets. The product does not resize, pause or delete anything; the customer's team makes every change.
- Ownership evidence comes from tags, role assignments and Microsoft Entra lookups. It shows who is connected to a resource, not that they have accepted responsibility for it; some findings have no owner.
- It does not replace Microsoft Cost Management.
- Contact: sales@mill5.com

## Pages

- [FinOps for AI on Azure](https://azurebestpractices.ai/): a sample AI estate you can try, what you leave with, how MILL5 works with you, MILL5's articles on AI cost, a scorecard for your own AI estate, and questions
- [Azure Best Practices Analyzer](https://azurebestpractices.com/): the full product, all 29 analyses by area

## What the analysis checks

- Model deployments and provisioned throughput: provisioned throughput (PTU) deployments with no traffic; PTU deployments with low peak utilization; PTU deployments that no reservation covers; under-used reservations; pay-per-token deployments with no traffic (no cost while idle, but they hold quota); high-volume deployments with a low prompt-cache hit rate
- Search, machine learning and GPU compute: Azure AI Search services with no query or indexing activity; Azure Machine Learning clusters set to keep nodes running between jobs; GPU clusters on dedicated virtual machines; compute instances with no idle shutdown; GPU virtual machines with almost no CPU activity (Azure does not report GPU use)
- Allocation and budgets: AI resources with no cost-allocation tags; subscriptions that hold AI resources and have no budget

## Related analyses in the same product

- Security Posture: Azure OpenAI, Microsoft Foundry and Azure AI Search services reachable from any network or allowing API key sign-in
- Cost Trends and Anomalies: spikes, month-over-month increases and forecasts above budget per subscription
- Commitment Utilization: under-used reservations, and savings plans where it has been given access to them

## MILL5 services

- Strategy: AI and cloud cost strategy and governance
- Accelerate: Azure Best Practices Analyzer and its FinOps for AI analysis sit here; MILL5 installs it with the customer's administrators and walks the customer's teams through the findings
- Build: carrying out approved changes, such as resizing provisioned throughput, removing unused deployments and setting tags and budgets
- Operate: cloud operations with cost governance and regular FinOps reporting
- The customer's team can also install and run it without MILL5 once the release has been supplied

## Optional

- [MILL5](https://www.mill5.com/): the company behind Azure Best Practices Analyzer