Capacity Auto-Pause and Resume

The platform can pause Fabric capacities on a schedule to save cost outside working hours. This runbook is for the platform team: how to configure, monitor and troubleshoot it. Workload teams read Cost optimisation.

How it works

Two consumption-tier Logic Apps are deployed in the shared resource group, one for pause and an optional one for resume. Each has a recurrence trigger, loops over the capacities of the deployment and calls the Azure Resource Manager suspend or resume action with its system-assigned managed identity.

flowchart LR
    t1["Recurrence: pause time, pause days"] --> p["Logic App: pause"]
    t2["Recurrence: resume time, resume days (optional)"] --> r["Logic App: resume"]
    p -->|"POST suspend (managed identity)"| cap["Fabric capacities of the shared deployment"]
    r -->|"POST resume (managed identity)"| cap
    p --> law["Log Analytics (diagnostics)"]
    r --> law
    law --> alert["Alert rule on failed runs"]
    alert --> ag["Action group (email)"]
    ops["Operator groups (custom role)"] -->|"manual resume: portal or CLI"| cap

The Logic Apps use the custom role Fabric Capacity Operator, scoped to the shared resource group: read, write, suspend and resume of Microsoft.Fabric/capacities. It cannot delete a capacity or read data. See Decisions.

Configuration

Set capacity_auto_pause in the variables of the shared tier. The feature is off by default.

capacity_auto_pause = {
  enabled    = true
  pause_time = "06:00 PM"
  pause_days = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday"]

  resume_enabled = false          # manual resume only (recommended)
  # resume_time  = "07:00 AM"
  # resume_days  = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday"]

  timezone      = "W. Europe Standard Time"
  alert_enabled = true
  alert_notification_emails = ["<team mailbox>"]
}

# Groups that may pause and resume manually in the portal
capacity_operator_group_ids = ["<entra-group-object-id>"]

Parameter	Default	Description
enabled	false	Master switch
pause_time	06:00 PM	Time to pause, format HH:MM AM/PM
pause_days	all seven days	Days to pause
resume_enabled	false	Deploy the resume Logic App
resume_time	08:00 AM	Only used when resume_enabled = true
resume_days	Monday to Friday	Only used when resume_enabled = true
timezone	W. Europe Standard Time	Windows time zone name for both schedules
alert_enabled	false	Alert rule for failed runs, with an action group
alert_notification_emails	none	Extra receivers of the action group

The time format and the day names are validated. The resource provider Microsoft.Logic is registered by the deployment.

A platform support address is always a receiver

The action group always contains a fixed platform support address that is written in the Terraform code, in addition to alert_notification_emails. In the managed model that is the intended support mailbox. If you run the platform yourself, change it in the code of your copy or accept that the address receives the alerts.

What is paused

The Logic Apps loop over all capacities that the shared deployment creates. They never touch capacities that belong to another deployment. To keep production running, keep the production capacity in a shared deployment where capacity_auto_pause.enabled is false, and the non-production capacities in the deployment where it is true. The workspaces find their capacity by name, so this does not change the workload tier.

Manual resume

Members of the groups in capacity_operator_group_ids hold the custom role and can resume at any time.

Portal: open the capacity in the shared resource group, choose Resume on the overview and wait until the status is Active (usually one to two minutes).

CLI:

az resource invoke-action --action resume \
  --ids "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Fabric/capacities/<capacity-name>"

Monitoring

When the feature is enabled, diagnostic settings send the WorkflowRuntime logs and metrics of both Logic Apps to the Log Analytics workspace of the spoke.

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.LOGIC"
| where resource_workflowName_s has_any ("cappause", "capresume")
| project TimeGenerated, resource_workflowName_s, status_s, error_message_s
| order by TimeGenerated desc
| take 50

Add | where status_s == "Failed" to see failures only.

With alert_enabled = true a scheduled query rule fires when a pause or resume run fails. It evaluates every 5 minutes over a 5 minute window with severity 2 (Warning) and notifies the action group.

Troubleshooting

Symptom	Check
Capacity did not pause	Open the run history of the Logic App. Check that its managed identity has the Fabric Capacity Operator role on the resource group. Pausing an already paused capacity is a no-op that logs as success.
Capacity did not resume	With resume_enabled = false this is expected. Otherwise check the run history of the resume Logic App, and that the capacity is not in a Deleting or Provisioning state.
Alert fired, capacity is fine	The failure may have been transient (for example Resource Manager throttling). Logic Apps retry transient failures. If the final state is right, acknowledge the alert.
Permission errors in runs	The role assignment was removed, or the Logic App was recreated and got a new identity. Run the shared tier deployment again: it recreates the assignment.

Related

• Cost optimisation
• Architecture