Daily cap

A daily cap protects the bill from a runaway log statement or retry loop. When ingestion reaches it, collection stops for the rest of a 24-hour period, and data that arrived over the cap is still billed. The reset hour can’t be configured.

Treat it as a fuse, not a budget. A cap that trips every day means the telemetry after that point is missing every day, and so is any incident that happens then. The fix is sampling or a quieter source, not a higher cap; the sampling and cost calculator turns a cap into the sampling percentage that stays under it.

Workspace-based Application Insights has two caps, its own and the workspace’s, and the lower one applies. Microsoft also warns that with an instrumentation key alone, without a connection string’s regional endpoint, the Application Insights cap may not be effective across regions. Auxiliary Logs tables aren’t subject to the cap.

To find out when it trips, query the workspace’s operation log, and turn the query into a log search alert:

_LogOperation
| where TimeGenerated > ago(1d)
| where Category =~ "Ingestion"
| where Detail contains "OverQuota"

For example, a workspace capped at 10 GB on a day its apps send 14 GB keeps about the first 10 GB, bills any overshoot that arrived before collection stopped, and drops the rest until the daily reset.