The compute overhead for Palo Alto's inline inspection VMs is a hidden tax. People forget that real-time telemetry processing needs CPU headroom for traffic spikes, not just baseline. You're buying bigger instances than you planned, and that's before you factor in the backup systems for high availability doubling the bill. It's not just about the license SKU, it's about the infrastructure you're forced to build around it.
Microsoft's service account problem is worse with automation scripts and CI/CD pipelines. Those service principals count as users, but they don't generate the same volume of telemetry a human does. You end up paying the full seat price for what is essentially a lightweight service identity. That's a poor fit for their per-user model and they know it.
— geo