Welcome to the Learning FOCUS blog series. If this is your first post, I recommend you start with Introducing an open billing data format to get a high-level picture of what the FinOps Open Cost and Usage Specification (FOCUS) is and what it covers. This week, I’ll cover the columns that identify and categorize services. How services are tracked in FOCUS is unique compared to native Cost Management datasets, so you may find some interesting benefits if you’re used to actual or amortized datasets.

⮜ Previous post (Resources)   ·   Next post (SKUs) ⮞

What is a FOCUS service?

In my last post, I discussed the FOCUS columns that identify and describe the resources you’ve deployed to your environment. Each of these resources has a specific type, like a virtual machine or a database or a web app. And each of these resource types are part of a larger service, which is what we’ll discuss today. But before I dig into services, we should take a step back and look at a FOCUS dataset more holistically.

Most people think about FOCUS as a solution for cloud resource usage and billing. And while that’s true, that’s only part of the story. FOCUS has the potential to support any type of costs – not just cloud costs, but SaaS, on-premises, professional services, and more. While the initial releases were heavily optimized for cloud costs, there’s no reason why someone couldn’t use FOCUS for non-cloud and even non-technology costs. Whether you’re purchasing tangible products or performance-based services, FOCUS refers to the overarching thing you’re paying for as a “service” and offers three columns to identify and organize your services.

Service name

The ServiceName column represents the name of the service you’re using or purchasing. Whether that’s something like Virtual Machines or even professional services like consulting, training, or support. Each of these are examples that you would identify with the ServiceName column. Fairly straightforward.

If you’re familiar with Microsoft’s cost and usage details, then you might assume this is the same thing as the MeterCategory column, which we have also referred to as ServiceName in the past, but they’re not quite the same. Some people are surprised when they realize the cost of the “Virtual Machines” meter category doesn’t match the cost for the virtual machine resource type. To demonstrate, we have $41K in virtual machine resource costs in the test account we use. The “Virtual Machines” meter category has $140K. You might think this makes sense because of other non-VM costs in the service, if I break it down, I’ll see:

• $25.5K from virtual machine resources using the “Virtual Machines” meter category
• $15.2K from virtual machine resources using other meter categories
• $114K from other resources using the “Virtual Machines” meter category

This may seem odd, but it’s the difference between services, resources, and SKUs (or “meters” as we’ve referred to them historically in Azure). While MeterCategory is a grouping of meters you’re charged for, FOCUS ServiceName spans all the meters you’re charged for – whether they’re compute, network, or storage costs, as an example – for a given service. (Although note that some resources explicitly use other resources from other services, like virtual machines with unmanaged disks using the Azure Storage service rather than disks as part of the Virtual Machines service.)

I’ll explain SKUs (and meters) in more detail in the next blog post, but the main point I want to call out is that the FOCUS ServiceName column is different from the SKUs you’re ultimately charged for, which is what meter category is related to.

The simplest way to think about it is that ServiceName represents the provider’s overarching offering that makes specific resource types available. Every resource type rolls up to a specific service. So the virtual machine resource type is part of the Virtual Machines service, the storage account resource type is Azure Storage service, and so on. These resources may also be consumed by other services or “managed applications”, like Azure Kubernetes Service, but for the sake of cost and usage, the service being used is the native service offering. I’ll talk more about these mappings in a bit.

Organizing costs across services

If you’re in a large organization that uses many services, it can be daunting to track each of the service names and understand what they do. This gets worse as you modernize and drive efficiencies, like moving from IaaS to PaaS or even across PaaS solutions, like moving from SQL to NoSQL or big data analytics systems, depending on what your needs are. As you make these moves, it can be difficult to track at scale in a way that leadership can follow without getting lost in hundreds of different names. And if you’re reporting on cost across providers, this challenge gets even worse as the naming conventions for each provider requires their own secret decoder ring just to understand which services from which providers offer similar functionality for the sake of conveying your overall costs across common categories, like compute, network, and storage. This is where ServiceCategory and ServiceSubcategory come in.

FOCUS offers the ServiceCategory column to provide a high-level, provider agnostic categorization of services. The categories were developed collaboratively by looking at major cloud and SaaS provider offerings to establish a baseline that should work for most services. Of course, we do expect them to change over time as we learn from others, so please be vocal and submit feedback to the FOCUS project if you spot anything missing or less than optimal.

FOCUS currently includes the following provider-agnostic service categories:

• AI and Machine Learning
• Analytics
• Business Applications
• Compute
• Databases
• Developer Tools
• Multicloud
• Identity
• Integration
• Internet of Things
• Management and Governance
• Media
• Migration
• Mobile
• Networking
• Security
• Storage
• Web
• Other

I’ll keep stressing these are provider-agnostic, which means you will see the same values whether you’re looking at cost data from Microsoft, AWS, GCP, OCI, or Tencent, which just shipped FOCUS 1.0 support in January. (Congrats!)

Of course, as great as this is, there are hundreds of services out there with thousands of different types of capabilities. A single level categorization isn’t quite enough, so FOCUS introduced ServiceSubcategory in FOCUS 1.1.

ServiceSubcategory adds a second layer categorization for services within each service category. And again, this is a provider-agnostic categorization that will apply to all providers when they add support for FOCUS 1.1.

• AI and Machine Learning
  • AI Platforms
  • Bots
  • Generative AI
  • Machine Learning
  • Natural Language Processing
  • Other (AI and Machine Learning)
• Analytics
  • Analytics Platforms
  • Business Intelligence
  • Data Processing
  • Search
  • Streaming Analytics
  • Other (Analytics)
• Business Applications
  • Productivity and Collaboration
  • Other (Business Applications)
• Compute
  • Containers
  • End User Computing
  • Quantum Compute
  • Serverless Compute
  • Virtual Machines
  • Other (Compute)
• Databases
  • Caching
  • Data Warehouses
  • Ledger Databases
  • NoSQL Databases
  • Relational Databases
  • Time Series Databases
  • Other (Databases)
• Developer Tools
  • Developer Platforms
  • Continuous Integration and Deployment
  • Development Environments
  • Source Code Management
  • Quality Assurance
  • Other (Developer Tools)
• Identity
  • Identity and Access Management
  • Other (Identity)
• Integration
  • API Management
  • Messaging
  • Workflow Orchestration
  • Other (Integration)
• Internet of Things
  • IoT Analytics
  • IoT Platforms
  • Other (Internet of Things)
• Management and Governance
  • Architecture
  • Compliance
  • Cost Management
  • Data Governance
  • Disaster Recovery
  • Endpoint Management
  • Observability
  • Support
  • Other (Management and Governance)
• Media
  • Content Creation
  • Gaming
  • Media Streaming
  • Mixed Reality
  • Other (Media)
• Migration
  • Data Migration
  • Resource Migration
  • Other (Migration)
• Mobile
  • Other (Mobile)
• Multicloud
  • Multicloud Integration
  • Other (Multicloud)
• Networking
  • Application Networking
  • Content Delivery
  • Network Connectivity
  • Network Infrastructure
  • Network Routing
  • Network Security
  • Other (Networking)
• Security
  • Secret Management
  • Security Posture Management
  • Threat Detection and Response
  • Other (Security)
• Storage
  • Backup Storage
  • Block Storage
  • File Storage
  • Object Storage
  • Storage Platforms
  • Other (Storage)
• Web
  • Application Platforms
  • Other (Web)
• Other
  • Other (Other)

I can’t understate the value of this being a provider-agnostic categorization. You can only imagine the countless hours that went into this and the debates required to flesh it out and drive consensus. Many props go to Shawn Alpay for driving this one to completion.

Of course, the one caveat here is that ServiceSubcategory is a part of FOCUS 1.1 and as of the time of this writing, nobody has implemented FOCUS 1.1 yet, so this isn’t quite ready for immediate consumption just yet. But I do have a workaround…

Microsoft’s open-source service categorization

While Microsoft was the first to support FOCUS 0.5 in June 2024 via the FinOps toolkit and FOCUS 1.0 in November 2024 in Cost Management, we also believe that it’s important to support others building tools, like the FOCUS converters from the FinOps Foundation, or performing data cleanup and prep work. To facilitate this, Microsoft open-sourced the service mapping they use for FOCUS in the FinOps toolkit.

Here's a sample:

This mapping allows you to map the ConsumedService and ResourceType columns from native cost data schemas to ServiceCategory, ServiceSubcategory, and ServiceName. So, if you’re interested in ServiceSubcategory, you can always use this mapping to augment your datasets, whether they’re FOCUS or not. This can be especially powerful for organizations with existing tooling that may be difficult to convert to FOCUS. Augmenting existing tooling with valuable FOCUS constructs can make it easier to get the value out of FOCUS even if you don’t have full adoption yet. Don’t let “perfect” get in the way of progress!

And one bonus you’ll find with this dataset is that you not only get the FOCUS columns, but you’ll also get Environment and ServiceModel columns, which you may find useful. Environment indicates whether a resource type is for Cloud, Hybrid, or On-Premises workloads; and ServiceModel indicates whether it’s IaaS, PaaS, or SaaS.

To learn more about the Services mapping file and other open data files in the FinOps toolkit, see Open data for FinOps.

Transitioning to FOCUS

Whether you’re updating reports, transforming data, validating FOCUS, or simply curious about how FOCUS compares to the historical actual and amortized datasets, you’re probably looking for a more direct mapping of columns. We have separate articles covering each of these scenarios in more detail, but here’s a summary regarding the date columns I covered above.

You may notice I’m calling out ConsumedService as the logical equivalent to ServiceName rather than MeterCategory. Again, MeterCategory is a different logical construct, which I covered earlier. But I didn’t talk about ConsumedService. ConsumedService is typically the Azure resource provider namespace (e.g., Microsoft.Compute). In some cases, it may be another value, but generally refers to the overarching service for the resource, which is what makes it the closest logical equivalent to FOCUS ServiceName.

For more details, refer to the following articles:

• Update reports to use FOCUS columns
• Convert cost and usage data to FOCUS
• Validate FOCUS data

Reviewing cost in Power BI

I must admit, I love looking at the service hierarchy in FOCUS. Having such a clean, provider-agnostic categorization of services makes it incredibly easy to track cloud cost at scale. This is especially important for enterprise leaders who don’t have detailed knowledge of every resource. We’ll use the FinOps toolkit Cost summary report again to review costs by service.

We’ll start with the Services page, which shows costs broken down by service. The chart shows costs by ServiceCategory and the table shows a breakdown of costs by ServiceCategory, ServiceName, ResourceType, and ResourceName. This page helps you identify the top service categories, with options to drill into the top cost drivers at each level.

Next, I’ll show the Regions page to demonstrate how you can mix what may seem to be unrelated attributes to give you an interesting peek into usage patterns. The Regions page shows the regions which incur the most cost with a breakdown by ServiceName and ResourceName. Here, ServiceName offers as a higher-level breakdown to group similar resources.

Lastly, I’ll show the Resource inventory page. The Resource inventory page summarizes cost by resource type but also provides details about how many resources you might have and what the average cost per resource is over the period. Of particular interest for us today is how the resource types are grouped by ServiceCategory and ServiceName in the table along with a ServiceCategory breakdown in the decomposition chart to the right of the table. Again, these are helpful ways to aggregate the resource types at scale.

Of course, we could add ServiceCategory and ServiceName to any breakdown. Start by looking at how your leadership thinks about cloud cost at scale. Some organizations may even utilize the service hierarchy for chargeback or more generalized reporting. Explore options and see what works best for your organization.

To learn more about these and other reports, see FinOps toolkit Power BI reports.

Querying cost in FinOps hubs

Now let’s look at a few queries you can run using FinOps hubs with Data Explorer. Investigating higher-level service costs is one of the most common ways to aggregate cost at scale for leaders across the organization, so this will be important as your cloud usage grows.

And since we’re looking at cost at scale, let’s look at monthly costs for the top service categories. We’ll start with a chart:

Costs
| summarize
    EffectiveCost = sum(EffectiveCost)
    by
    Month = startofmonth(ChargePeriodStart),
    ServiceCategory
| render columnchart with (kind=stacked)

And if you want to see that in a table, we can pivot the data to make it easier to compare each month:

Costs
| summarize
    EffectiveCost = round(sum(EffectiveCost), 2)
    by
    Month = substring(startofmonth(ChargePeriodStart), 0, 7),
    ServiceCategory
| order by Month desc
| evaluate pivot(Month, sum(EffectiveCost), ServiceCategory)

Now let’s look at the top 10 services and include resource count and cost per resource:

Costs
| where isnotempty(ResourceId)
| summarize
    EffectiveCost = round(sum(EffectiveCost), 2),
    ResourceCount = dcount(ResourceId)
    by
    ServiceName
| extend ['Cost / Resource'] = round(EffectiveCost / ResourceCount, 2)
| top 10 by EffectiveCost

This is only covering a few examples, but you should find them helpful in establishing some of the basic reports you’ll need for your teams. We’ll continue to build on these columns in future blog posts to demonstrate more interesting scenarios as we go. Leave a comment if you’d like to see any specific queries and I’ll make sure to cover it.

What next?

At this point, we have a high-level understanding of the types of charges we’re incurring, how much we’re being charged, when we incurred those charges, what resources we deployed that incurred the charges, and what services those resources rolled up to. Next, we’ll dig into the underlying SKUs those resources are using that incur the charges you’ll see in your cost data.

If you need a refresher or have any questions about previous topics, this is a good time to review them. We’ll touch on a little of everything given the overlapping concepts.

• Introduction
• Costs
• Charge types and pricing models
• Dates
• Resources

For a more directed walkthrough, the FinOps Foundation offers a free Introduction to FOCUS course. When you’re ready to dig into your own FOCUS data, check out the Power BI reports in the FinOps toolkit. These reports offer a great starting point that you can customize to meet your needs. And if you’re looking for more advanced analytics that can handle data at scale, check out FinOps hubs, which offer additional benefits, like pre-calculated savings for EA and MCA accounts.

⮜ Previous post (Resources)   ·   Next post (SKUs) ⮞