Cloud questions, answered in writing

Not in the portal's cost summary. Start with the cost export, because the summary rolls things up in a way that hides the answer.

The first thing worth knowing is whether this was a step or a ramp. Pull daily cost for the last ninety days and look at the shape. A step on a single day is almost always a commitment expiring, a tier change, or something new that got deployed and nobody tracked. A ramp is usually growth in storage, egress or log ingestion.

If it is a step, there are two usual causes and it is worth checking both before you look anywhere else. The first is reservation and savings plan expiry, which produces a large jump with no corresponding change in what you are running, and which people rule out last precisely because nothing in the environment changed. The second is something that got deployed or restored and never deprovisioned once the work was done. Restores are the quieter half of that: someone recovers a VM or a database to check something, it works, and the copy simply stays.

If it is a ramp, group the export by meter category rather than by resource group and sort by the change rather than the total. Resource group tells you who owns it, but meter tells you what it actually is, and the two biggest quiet climbers are usually egress and log ingestion.

One more worth a look: anything deployed in a different region than the workload it serves. Cross region traffic is metered, easy to create by accident, and almost never shows up as a line item anyone recognizes.

Consolidate or leave it alone is the second question. The first one is whether you actually control what you just bought.

Start by making sure the acquiring organization has its own administrators in place. At close you own the company, but privileged access to that environment usually still sits with the people who sold it to you, and sometimes with a former provider nobody has thought to tell. Until your own admins and billing ownership are in place, every other decision here is theoretical.

Then review the identities that came with it. Who holds standing access, what service principals and app registrations exist and what they can reach, and which accounts belong to people who left at close. This is the step that takes real risk off the table in the first week, and it is usually the step that turns up something nobody raised in diligence.

Third, work out what the acquired estate does to your own compliance position, because it sits inside your perimeter now. If you are under SOC 2 or HIPAA, what is running over there is in scope whether or not anyone has looked at it yet. That is what tends to set the real timeline. Cost rarely forces the schedule. Compliance often does.

Migrating identities and ownership records is the fourth step, and it is the one to plan rather than rush. It is genuinely expensive: it touches identity, licensing, every service principal, and anything holding a hardcoded tenant reference. So the honest answer to the question as asked is usually neither option. You do not leave it alone for a year, because the first three steps will not wait that long. You also do not merge in month one. You take control now, and you migrate on a plan, as the business allows.

In most cases the control already exists and the evidence does not. That distinction matters, because it changes the work from a project into an afternoon.

On logging, an auditor is usually asking three things. Is it centralized, is retention defined, and does retention match what your policy claims. A single Log Analytics workspace with a retention period that matches your written policy closes most findings. The common failure is a policy saying one year and a workspace configured to ninety days, which is a documentation fix rather than an engineering one.

On access reviews, they want evidence that someone looked and that something happened as a result. If you have Entra ID P2, access reviews will generate that evidence for you on a schedule. If you do not, a quarterly review recorded in a document, with dates and named reviewers and the removals that resulted, is accepted by most auditors. A review that finds nothing and removes nobody looks like a review that did not happen.

The thing worth avoiding is buying tooling to solve an evidence problem. It is a common and expensive reflex, and it usually adds a system to administer without producing the artifact the auditor actually wanted.