I never created a workspace for log analytics and now I'm being charged thousands of dollars.

Hello Ryan Thomas

Thank you for reaching out to the Microsoft Q&A forum. 

When investigated  it sounds like a Log Analytics workspace got auto-provisioned (you’ll see it as “workspaceeregetebe70”) and is ingesting data you didn’t explicitly send—hence the surprise charges. Here’s how to get to the bottom of it and stop the bleeding:

1. Check what’s driving those ingestion costs
   • In the Azure portal, go to Cost Management + Billing > Cost analysis.
   • Filter by “Resource” = workspaceeregetebe70 (or by “Log Analytics workspace”) and look at the breakdown by SKU, ingestion, and retention.
   • In the workspace itself, open Usage and estimated costs to see which data types (Windows Event, Performance Counters, etc.) are contributing most.
2. Identify what’s sending data
   • Go to the workspace > Workspace summary or Solutions blade and see if any built-in solutions (e.g. VM insights, Security Center or Sentinel) are enabled.
   • Check each VM, App Service, Storage Account, etc. for Diagnostic settings pointing to that workspace. If you find any, you can disable or redirect those settings.
3. Stop further ingestion
   • If you’re not using the workspace, you can delete it: Workspace > Delete.
   • If you still need it but want to slim down charges, adjust retention (Workspace > Usage and estimated costs > Data Retention) or turn off specific data solutions you don’t need.
4. Prevent auto-provisioning in the future
   • Services like Security Center or Azure Monitor sometimes auto-create a default workspace when you turn them on. If you’re not using those services, disable them or use Azure Policy to block auto-provisioning.
5. (Optional) Request a cost credit
   • If this workspace was created by mistake by a Microsoft service and caused unexpected charges, you can open a support request and ask for a one-time billing credit.

Hope this helps you pinpoint what’s going in and stop any unwanted charges! Let me know if you need more details on any step.

Follow-up questions

• When did you first notice the charges spiking?

• Which data types (logs, metrics, etc.) are showing the highest ingestion?

• Are you using any Azure services like Security Center, Sentinel or VM insights that might auto-send data?

• Do you’ve any diagnostic settings enabled on your VMs, App Services or other resources?

References

1. Review and control Azure Monitor usage & costs: https://learn.microsoft.com/azure/azure-monitor/costs
2. Cost analysis in Azure Cost Management: https://learn.microsoft.com/azure/cost-management-billing/cost-management/cost-analysis
3. Disable or delete a Log Analytics workspace: https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-delete
4. Azure Monitor diagnostic settings overview: https://learn.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings
5. Prevent auto-provisioning of Log Analytics workspaces with Azure Policy: https://learn.microsoft.com/azure/governance/policy/concepts/assignments