VMs, disks, SQL, and subscription security in one Reader scan.

Every check we run on Azure

All 217 checks, generated directly from the scanner so this list matches what actually runs. Search for a service to see whether your stack is covered.

No Azure check matches that. It may be covered on another cloud, or it may be something we do not scan yet. Ask us about it .

• Commitment opt-in

  Azure Hybrid Benefit underused

  Windows / SQL spend in the billing data that appears to run at license-included rates where Azure Hybrid Benefit could apply.

• Commitment opt-in

  Reservation coverage gap

  On-demand VM/SQL spend that an Azure Reservation would reduce, from Microsoft's own reservation recommendations.

• Commitment opt-in

  Reservation under-utilization

  Purchased Azure Reservations whose average utilization is below the efficiency threshold. Paying for unused commitment.

• Commitment opt-in

  Savings plan coverage gap

  Compute benefit / savings-plan utilization is low (or absent), indicating compute spend not covered by a savings plan.

• Compute

  AI Search Standard+ tiers in non-prod

  AI Search services on Standard or higher SKUs whose name/tags look non-production. Search bills a fixed fee per unit (replica x partition) around the clock. Dev/test indexes almost always fit Basic (or Free).

• Compute

  AI Search replicas > 1 in non-prod

  Non-production AI Search services running more than one replica. Extra replicas exist for query HA/throughput. Dev/test rarely needs either, and each replica multiplies the per-unit fee. Standard+ non-prod services are covered by AZ_SEARCH_STANDARD_NONPROD instead.

• Compute

  AKS Standard tier on non-prod clusters

  Dev/test AKS clusters paying the Standard-tier (uptime SLA) management fee (~$73/mo). The Free tier suffices off-prod.

• Compute

  AKS node pools on managed OS disks

  Node pools using network-attached managed OS disks instead of ephemeral OS disks. Ephemeral disks are free (they live on the VM's local/cache storage), faster, and ideal for stateless nodes. But require a VM size whose cache fits the image, so this stays informational and default-off.

• Compute

  App plans where every site is stopped

  Paid App Service plans whose sites are ALL stopped. Stopped sites cost nothing, but the plan's instances bill 24/7 regardless. Complements AZ_APP_PLAN_EMPTY (zero sites).

• Compute

  Batch pools holding dedicated nodes in non-prod

  Batch pools with steady dedicated nodes allocated in accounts/pools that look non-production. Dedicated nodes bill the VM rate 24/7 between job runs. Non-prod pools should scale to zero (autoscale formula or low-priority/Spot nodes).

• Compute

  Container groups running 30+ days

  ACI container groups alive for 30+ days with restart-policy Always. ACI's per-second pricing is built for bursts. A permanent service is usually cheaper on a small VM, App Service, or AKS.

• Compute opt-in

  Cost recommendations (Azure Advisor)

  Microsoft Advisor cost recommendations. VM shutdown / resize and reservation purchases. With Advisor's own projected savings.

• Compute

  Dedicated hosts running 0-1 VMs

  Dedicated hosts placing one VM or none. A host bills its full hourly rate regardless of placements. An empty host is pure waste, and a single-VM host usually costs several times the equivalent standalone VM.

• Compute

  Dev AKS clusters without Spot node pools

  Non-prod clusters (name/tag inference) whose user pools all run regular-priority VMs. Spot pools cut node compute 60-90% for eviction-tolerant dev workloads. Informational.

• Compute uses metrics

  Elastic Premium plans with near-zero executions

  Function App Elastic Premium (EP) plans whose function apps executed almost nothing over the lookback. EP pre-warmed instances bill 24/7; idle workloads belong on Consumption.

• Compute

  Empty App Service plans

  Paid App Service plans hosting zero sites. The plan bills its full instance price whether or not any app is deployed.

• Compute

  HDInsight clusters running in non-prod

  Running HDInsight clusters whose name/tags look non-production. HDInsight cannot be paused. Every node bills VM rate plus the HDInsight surcharge 24/7, so dev clusters should be deleted and recreated on demand (storage is decoupled).

• Compute

  Long-deallocated zombie VMs

  VMs deallocated for 30+ days. Compute is free, but their managed disks and static public IPs keep billing every month.

• Compute

  Non-prod AKS clusters running 24/7

  Dev/test/staging AKS clusters (name/tag inference) running around the clock. `az aks stop` deallocates every node pool off-hours.

• Compute

  Non-prod VMs not using Spot pricing

  Running non-prod VMs on regular (pay-as-you-go) priority. Spot offers 60-90% discounts for interruptible workloads. Informational: eviction tolerance can't be verified from ARM.

• Compute

  Non-prod VMs without auto-shutdown

  Running VMs that look non-production with no enabled DevTest auto-shutdown schedule targeting them. Burning nights and weekends for nothing.

• Compute

  Non-prod container apps with always-on replicas

  Container apps in non-production environments with minReplicas >= 1. Warm replicas bill the idle rate around the clock, while dev/test apps can usually scale to zero and eat the cold start.

• Compute uses metrics

  Oversized VMs (low CPU)

  Running VMs averaging < 5% CPU with peaks < 40% over the lookback window. One size down typically halves the bill.

• Compute

  Premium Databricks workspaces in non-prod

  Premium-SKU Databricks workspaces whose name/tags look non-production. The premium tier adds ~$0.15 per DBU on every cluster-hour the workspace runs.

• Compute

  Premium disks on burstable B-series VMs

  B-series (burstable, cost-optimized) VMs attached to Premium SSD disks. A sizing mismatch: the VM throttles long before Premium IOPS matter. Standard SSD usually suffices.

• Compute uses metrics

  Scale sets with low average CPU

  VM scale sets whose fleet-average CPU stayed under 10% (peak < 40%) over 14+ days. Reduce instance count or downsize the VM size.

• Compute

  Synapse Spark pools without auto-pause

  Spark (big data) pools with auto-pause explicitly disabled. The pool's nodes keep billing per vCore-hour after the last session ends until someone remembers to shut them down.

• Compute

  VMs stopped but not deallocated

  VMs in 'stopped' power state (shut down from the OS) still bill full compute. Only 'az vm deallocate' releases the hardware and stops the meter.

• Compute

  Windows VMs possibly missing Hybrid Benefit

  Running Windows VMs without Azure Hybrid Benefit. AHB removes the in-VM Windows license charge for orgs with Software Assurance. Informational: license entitlement can't be verified from ARM.

• Database uses metrics

  Cosmos DB low RU utilization

  Provisioned-throughput accounts whose normalized RU consumption never exceeded 20% of the provisioned ceiling. Scale-down or serverless candidates.

• Database uses metrics

  Cosmos DB provisioned RU/s on idle accounts

  Provisioned-throughput Cosmos DB (SQL-API) accounts that served almost no request units over the lookback, priced from their actual enumerated per-container/database provisioned RU/s rather than the 400 RU/s account-minimum floor.

• Database

  Cosmos multi-region writes in non-prod

  Cosmos accounts with multi-region writes enabled that look non-production. Every write region bills its own full RU provision. Multi-write roughly doubles the bill per region.

• Database uses metrics

  GP flexible servers fit for burstable compute

  General Purpose / Memory Optimized flexible servers with low sustained CPU. The burstable (B-series) tier serves the same load for a fraction of the price.

• Database

  Geo-replicated SQL secondaries in non-prod

  Geo-replication secondaries on databases whose name/tags look non-production. A geo secondary bills the FULL price of a second database. Rarely justified for dev/test.

• Database uses metrics

  Idle Cosmos DB accounts

  Provisioned-throughput Cosmos DB accounts that served almost no request units over the lookback. Provisioned RU/s bill around the clock whether queried or not.

• Database uses metrics

  Idle MySQL flexible servers

  MySQL flexible servers averaging < 5% CPU over 14+ days. Stop, downsize, or delete.

• Database uses metrics

  Idle PostgreSQL flexible servers

  PostgreSQL flexible servers averaging < 5% CPU over 14+ days. Stop, downsize, or delete.

• Database uses metrics

  Idle Redis caches

  Redis caches with ~zero connected clients and near-zero commands over the lookback. Cache instances bill hourly whether used or not.

• Database uses metrics

  Idle SQL Managed Instances

  Managed Instances averaging under 5% CPU over the lookback. MI bills its full vCore count 24/7. An idle one is among the largest single wastes on Azure (4 vCores minimum).

• Database uses metrics

  Idle SQL databases

  SQL databases averaging < 5% CPU over 14+ days. Provisioned compute bills 24/7 whether queried or not.

• Database

  Non-prod Managed Instances running 24/7

  Managed Instances that look non-production and are running. MI supports stop/start. A nights-and-weekends schedule cuts the compute bill by roughly two thirds.

• Database

  Non-prod Synapse SQL pools running 24/7

  Dedicated SQL pools that are Online in environments whose name/tags look non-production. Dedicated pools bill per DWU hour and can be paused on a schedule.

• Database

  Premium Redis in non-prod environments

  Premium-tier Redis caches whose name/tags look non-production. Premium buys clustering, persistence, and VNet injection. Rarely needed in dev/test.

• Database uses metrics

  Premium Service Bus with low message volume

  Premium Service Bus namespaces that have entities but moved almost no messages over the lookback. Premium bills ~$668/month per messaging unit regardless of throughput; low-volume workloads fit the Standard tier's per-operation pricing.

• Database uses metrics

  Provisioned SQL DBs fit for serverless

  Provisioned vCore databases with intermittent low usage. The serverless tier auto-pauses and bills per-second of actual use.

• Database uses metrics

  SQL DBs using <10% of a large max size

  Databases whose storage_percent metric averages under 10% of a max size above 50 GB. On vCore SKUs the provisioned max size drives the storage bill. Informational sizing signal.

• Database

  Serverless SQL with auto-pause disabled

  Serverless-SKU databases with auto-pause delay set to -1 (disabled). Without auto-pause a serverless DB bills compute continuously. Defeating the SKU's entire purpose.

• Database

  Servers with 3+ small DTU DBs (pool candidates)

  Logical servers running three or more small standalone DTU databases (Basic/S0-S2) outside any elastic pool. One shared pool usually costs less than the sum of the singles.

• Database

  Stopped flexible servers (storage still billing)

  Stopped PostgreSQL/MySQL flexible servers. Compute is paused, but provisioned storage and backups keep billing. And Azure auto-restarts the server after 30 days.

• Database

  Zone-redundant SQL DBs in non-prod

  Zone-redundant databases that look non-production. Zone redundancy adds a premium on most service tiers. Dev/test rarely needs AZ-level survivability.

• Governance

  AKS Image Cleaner disabled

  Clusters without the Image Cleaner (Eraser). Stale, potentially vulnerable images accumulate on node disks indefinitely. Free to enable.

• Governance

  AKS clusters without the Azure Policy addon

  Clusters without the Azure Policy (Gatekeeper) addon. No admission-time guardrails for privileged pods, registries, or labels. Informational.

• Governance

  AKS node pools behind the control plane

  Node pools whose orchestrator version differs from the cluster's control-plane version. Drifted pools miss security patches and eventually fall outside the supported skew, blocking the next control-plane upgrade.

• Governance

  AKS user node pools without cluster autoscaler

  Running user-mode node pools with the cluster autoscaler disabled. The pool holds its fixed node count through every quiet hour instead of scaling down.

• Governance

  API Management on retired stv1 platform

  APIM instances still on the stv1 compute platform, which Microsoft retired (31 Aug 2024 global; 2025 for VNet-injected). Unmigrated instances risk forced migration or shutdown.

• Governance

  Application Insights classic resources

  Application Insights components not bound to a Log Analytics workspace. Classic Application Insights was retired on 2024-02-29. These resources run on a dead platform with legacy (more expensive) ingestion billing.

• Governance

  Autoscale settings configured but disabled

  Microsoft.Insights autoscale settings that exist but are turned off. Someone configured scaling rules and then disabled them, so the target runs at a fixed (often peak) size.

• Governance

  Availability sets with 0-1 VMs

  Availability sets containing one VM or none. A single-VM set provides zero fault-domain benefit while implying an SLA it does not deliver; an empty set is leftover clutter. Both are free. The cost is operational confusion.

• Governance

  CDN profiles on shut-down providers (Edgio/Akamai)

  Classic CDN profiles on Edgio (formerly Verizon) or Akamai SKUs. Edgio shut down in January 2025 and Akamai exited in 2023. These profiles no longer serve traffic and any DNS still pointing at them is broken or hijackable.

• Governance

  Classic CDN endpoints stopped

  Endpoints on classic CDN profiles whose resourceState is Stopped. Configured but serving nothing. Dead wiring that keeps custom-domain CNAMEs alive (dangling-DNS risk).

• Governance

  Cognitive/OpenAI paid tiers in non-prod

  Cognitive Services / Azure OpenAI accounts on paid SKUs (S0 and up) whose name/tags look non-production. Billing is usage-based, so no dollar figure is claimed. But dev/test workloads often fit the free F0 tier, and idle paid accounts are unmonitored spend waiting to happen.

• Governance

  Container Apps environments with zero apps

  Managed environments hosting no container apps. A consumption-only environment is free while empty, but dedicated workload profiles with a minimum instance count keep billing. And an empty environment is clutter either way.

• Governance

  Cosmos continuous backup in non-prod

  Cosmos accounts on continuous (point-in-time-restore) backup that look non-production. Continuous backup bills a per-GB surcharge that periodic (2 free copies) does not.

• Governance opt-in

  Cost anomaly (per service)

  Per-service spend over the last 30 days that is large enough to warrant an anomaly review (no historical baseline fetched).

• Governance

  Data Explorer clusters stopped or without autoscale

  Azure Data Explorer (Kusto) clusters that are stopped, or running with optimized autoscale off. A stopped-but-allocated cluster and a fixed-size cluster both waste capacity.

• Governance

  Data Factories with zero pipelines

  Data Factory instances containing no pipelines. An abandoned or never-finished setup. Free while idle, but governance noise (and often paired with orphaned integration runtimes).

• Governance

  Defender auto-provisioning off

  The Defender for Cloud auto-provisioning default setting is Off. New VMs come up without the monitoring agent. Informational: deliberate in agentless setups.

• Governance

  Developer-tier APIM serving production

  Developer-tier APIM instances whose name/tags look production. The Developer tier carries NO SLA and no scale-out. An outage waiting to happen in a prod path.

• Governance

  Event Grid topics with zero subscriptions

  Custom/system topics with no event subscriptions. Published events go nowhere. Free to keep, but dead wiring that hides real integration failures.

• Governance

  Front Door (classic) instances

  Azure Front Door (classic) profiles. The classic SKU is deprecated (retirement announced for March 2027) and stopped accepting new customers in 2025. Migrate to Front Door Standard/Premium with the zero-downtime migration tool.

• Governance

  HDInsight clusters on legacy node families

  HDInsight clusters with roles on A-series or other legacy VM families. Old hardware with poor price/performance that newer Dv4/Ev4+ families beat at the same or lower price.

• Governance

  Integration Service Environments (retired platform)

  Logic Apps ISE instances. The platform was RETIRED on 2024-08-31. Surviving instances are unsupported, may stop working at any time, and still bill thousands per month. Migration to Logic Apps Standard is mandatory.

• Governance

  Key Vaults on legacy access policies

  Vaults using the legacy access-policy permission model instead of Azure RBAC. Access policies are vault-local, unauditable through standard role assignments, and deprecated. Informational.

• Governance

  Lifecycle policy without last-access tracking

  Accounts that have a lifecycle management policy but last-access-time tracking disabled. Any tier-by-last-access rules silently can't fire, so cold data never moves to Cool/Archive.

• Governance

  Log Analytics: no daily cap + long retention

  Workspaces with no daily ingestion cap AND retention beyond the included 31 days. A runaway log source can compound ingestion cost with months of paid retention.

• Governance

  Logic App workflows disabled 90+ days

  Consumption workflows disabled for 90+ days. Free while disabled, but dead wiring that hides whether anything still depends on them.

• Governance

  Long-term retention on non-prod SQL DBs

  Long-term backup retention configured on databases that look non-production. LTR storage accrues for years on data nobody will ever restore.

• Governance

  NSGs associated with nothing

  Network security groups attached to no subnet and no NIC. Free, but dead rule sets rot: they get copy-pasted, and their stale allow rules resurface attached to something real.

• Governance

  NSGs with no flow log configured

  Network security groups with no NSG flow log on the region's Network Watcher. Without flow logs there is no network forensics trail for who-talked-to-whom investigations.

• Governance

  Notification Hub namespaces mis-tiered for their use

  Notification Hub namespaces on a Free/Basic SKU whose name/tags look production, or paid namespaces that contain zero hubs (provisioned but unused).

• Governance

  Orphaned network interfaces

  NICs attached to no VM and no private endpoint. Free, but they hold subnet IPs and accumulate as IaC drift.

• Governance

  Premium registries in non-prod environments

  Premium-tier registries whose name/tags look non-production. Standard handles dev/test workflows at 40% of the price.

• Governance

  Premium registries with no geo-replication

  Premium-tier registries with no extra geo-replications configured. Geo-replication is the headline Premium feature; without it, Standard would serve the same workload for less.

• Governance

  Premium registries without untagged-manifest retention

  Premium registries with the retention policy for untagged manifests disabled. Dangling layers accumulate forever and the storage bill quietly grows.

• Governance

  Premium/Standard APIM in non-prod

  Premium or Standard API Management instances whose name/tags look non-production. The Developer tier offers full feature parity (no SLA) at a fraction of the price.

• Governance

  Private DNS zones linked to no VNet

  Private DNS zones with zero virtual-network links. No VNet can resolve them, so every record they hold is unreachable. Each zone bills a small fixed monthly fee.

• Governance

  Private endpoints in a disconnected state

  Private endpoints whose link connection is Disconnected, Rejected, or stuck Pending. The NIC keeps billing while the endpoint routes nowhere useful.

• Governance

  Prod resource groups without delete locks

  Resource groups that look production with no CanNotDelete/ReadOnly lock covering them. One bad script away from a deleted environment. Informational, default-off.

• Governance

  Production AKS clusters on the Free tier

  Clusters that look production but run the Free management tier. No uptime SLA on the API server and a 10-node-pool scale ceiling. The inverse of AZ_AKS_PAID_TIER_NONPROD: this one recommends spending ~$73/month for the SLA.

• Governance

  Production Cosmos accounts without zone redundancy

  Cosmos DB accounts that look production but have no availability-zone redundancy on any region. A single-zone outage can take the account's region offline.

• Governance

  Recovery Services vaults protecting nothing

  Vaults with zero protected items. Either an abandoned backup setup or a vault whose protections were all removed. Free, but a governance smell (and often paired with stale policies).

• Governance

  Recovery Services vaults without immutability

  Backup vaults with immutability not enabled. Immutable vaults block backup data from being shortened or deleted before its retention expires - a strong tamper-protection control.

• Governance opt-in

  Reliability recommendations (Azure Advisor)

  Microsoft Advisor high-availability / reliability recommendations.

• Governance

  Route tables associated with no subnet

  Route tables referenced by zero subnets. Free, but stale UDRs are a classic source of 'why is traffic blackholed' incidents when someone reattaches them years later.

• Governance

  SignalR/Web PubSub mis-tiered for production

  SignalR or Web PubSub services on the Free tier whose name/tags look production. The Free tier caps concurrent connections and messages and carries no SLA.

• Governance

  Spot VMs tagged as production

  Spot (low-priority) VMs whose name/tags look production. Spot instances can be evicted with 30 seconds notice - a poor fit for a workload labelled prod.

• Governance

  Standard Static Web Apps not using Standard features

  Static Web Apps on the Standard (paid) tier with no custom domains and no linked functions - none of the features that justify Standard over the Free tier are in use.

• Governance

  Standard load balancers relying on default SNAT

  Standard load balancers with a non-empty backend pool and load-balancing rules but no explicit outbound rule. They fall back to default SNAT, which is prone to port exhaustion.

• Governance

  Standard public IPs that are not zone-redundant

  Attached Standard public IPs pinned to a single availability zone or with no zone set. A single-zone IP becomes unreachable if that zone fails.

• Governance

  Storage accounts without blob soft delete

  Accounts whose blob service has no delete-retention policy. A deleted or overwritten blob is gone immediately.

• Governance

  Stream Analytics jobs stopped or failed

  Stream Analytics jobs in a Stopped or Failed state. A job that is not running processes no events - and a failed pipeline is a silent data-loss gap until someone restarts it.

• Governance

  Subscriptions without a budget

  Subscriptions with zero Consumption budgets configured. Budgets are free and the only native guardrail that alerts before a runaway resource becomes a five-figure invoice.

• Governance

  Synapse workspaces with zero pools

  Synapse workspaces with no dedicated SQL pools and no Spark pools. The workspace itself is nearly free (serverless SQL is pay-per-query). But an empty workspace is usually an abandoned project with its storage account still attached.

• Governance

  Traffic Manager profiles with no healthy endpoint

  Enabled Traffic Manager profiles whose endpoints are all disabled, degraded, or stopped. The profile routes nothing while health checks on enabled endpoints keep billing.

• Governance

  User-assigned identities assigned to nothing

  User-assigned managed identities not attached to any collected VM, VMSS, Web/Function App, or AKS cluster. An unattached identity does nothing. But its role assignments stay live, waiting for whoever attaches it next.

• Governance

  VM extensions in a failed state

  Virtual machines with one or more extensions stuck in a failed provisioning state. A failed Monitor/Defender/CustomScript extension silently breaks monitoring, patching, or security agents while the VM looks healthy.

• Governance

  VMs without automatic patch assessment

  Running VMs whose patch assessmentMode is not AutomaticByPlatform. Without it there is no automatic patch compliance signal in Azure Update Manager / Defender.

• Governance

  VMs without boot diagnostics

  VMs with boot diagnostics explicitly disabled. Boot diagnostics is free (managed storage) and is the only way to see the console of a VM that hangs during boot. Without it, a boot loop means restore-from-backup.

• Governance

  VNet peerings in Disconnected state

  VNet peerings whose state is Disconnected. The remote side was deleted or never completed, leaving a half-configured link that routes nothing.

• Governance

  VPN/ER connections not connected

  Gateway connections whose status is NotConnected. The tunnel is configured (and the gateway billed) but down.

• Governance

  Web apps without managed identity

  Running web/function apps with no managed identity. Secrets for downstream Azure services are likely embedded in app settings instead. Informational.

• Governance

  Zero Azure Policy assignments at subscription

  No Azure Policy assignments exist at the subscription scope. No guardrails on locations, SKUs, tagging, or security defaults anywhere in the subscription.

• Network

  App Gateway v2 without autoscaling

  Application Gateway v2 instances running fixed capacity instead of autoscaling. Fixed instances bill their capacity units 24/7; autoscale (even min 0) only pays for what traffic actually needs.

• Network

  Application Gateway v1 (retired April 2026)

  v1 Application Gateways (Standard/WAF). Azure retired the v1 SKU on 28 April 2026. Unmigrated gateways face forced migration or service interruption.

• Network

  Application Gateways with no backends

  Application Gateways whose backend pools are all empty. The fixed hourly charge (plus WAF) routes zero traffic.

• Network

  Basic SKU load balancers (retired)

  Basic SKU load balancers were retired September 2025 alongside Basic public IPs. Migrate to Standard SKU.

• Network

  Basic SKU public IPs (retired)

  Basic SKU public IPs were retired September 2025. Remaining ones must be migrated to Standard SKU. Plan the migration before forced changes break connectivity.

• Network

  Bastion hosts in non-prod environments

  Bastion hosts whose name/tags look non-production. Bastion bills per hour 24/7. For dev/test, the free Developer SKU or on-demand deployment usually suffices.

• Network

  DDoS protection plans protecting nothing

  DDoS Network Protection plans with zero protected VNets-~$2,944/month for nothing. One of the largest single-resource wastes on Azure.

• Network opt-in

  Egress top talkers

  The largest network egress / bandwidth cost lines over the last 30 days, from the Cost Management spend breakdown.

• Network

  ExpressRoute circuits not provider-provisioned

  ExpressRoute circuits whose connectivity provider side is not provisioned. Azure bills from the moment the service key is created. These circuits cost money and carry zero traffic.

• Network

  ExpressRoute gateways with no connections

  ExpressRoute virtual network gateways referenced by zero connections. The gateway bills hourly while terminating no circuit at all.

• Network uses metrics

  Fixed-tier APIM that fits the Consumption tier

  Developer/Basic/Standard API Management instances whose monthly request volume is low enough to fit the serverless Consumption tier (per-call pricing, first 1M calls free) instead of a fixed monthly unit charge.

• Network

  Load balancers with no backends

  Standard load balancers whose backend pools are all empty. The hourly base charge buys nothing.

• Network

  NAT gateways attached to no subnet

  NAT gateways not associated with any subnet. The hourly resource charge applies whether or not anything routes through it.

• Network

  Premium Event Hubs namespaces with zero hubs

  Premium/Dedicated Event Hubs namespaces that contain no event hubs at all. Capacity-unit billing with nothing inside.

• Network uses metrics

  Premium Event Hubs with low ingress

  Premium/Dedicated Event Hubs namespaces whose incoming-message volume fits comfortably on the Standard tier.

• Network

  Premium Service Bus namespaces with no entities

  Premium Service Bus namespaces containing zero queues and zero topics-~$677/month per messaging unit for nothing.

• Network uses metrics

  Standard load balancers carrying no traffic

  Standard load balancers that have load-balancing rules but moved essentially no bytes over the lookback. A Standard LB bills an hourly base plus a per-rule charge whether or not any traffic flows through it.

• Network

  Unattached public IPs

  Public IP addresses not associated with any NIC, LB frontend, or NAT gateway. Azure bills idle IPs by the hour.

• Network

  VPN gateways with no connections

  VPN virtual network gateways referenced by zero connections. The gateway bills hourly whether or not a tunnel exists.

• Security

  AKS API servers open to the Internet

  Running public AKS clusters with no authorized IP ranges. The Kubernetes API endpoint accepts connections from any Internet address.

• Security

  AKS clusters on unsupported Kubernetes

  Clusters running a Kubernetes minor that has left AKS standard support (best-effort 2026-Q2 window). No CVE patches without an upgrade or paid LTS.

• Security

  AKS clusters with local accounts enabled

  Clusters where disableLocalAccounts is not set. Local admin kubeconfigs bypass Entra ID auth and RBAC audit.

• Security

  App Configuration stores open to the internet

  App Configuration stores with public network access enabled and no private endpoint. Configuration (sometimes including secrets references) is reachable from any network.

• Security

  App Service sites with SCM basic auth enabled

  App Service sites where SCM (Kudu) basic publishing credentials are still allowed. The publish password is a static secret that bypasses Entra ID and its audit trail.

• Security

  Application Gateways serving HTTP with no HTTPS redirect

  Application Gateways with an HTTP listener but no redirect configuration. Plain-HTTP requests are served as-is instead of being upgraded to HTTPS.

• Security

  CIS activity-log alerts missing

  Subscriptions without enabled activity-log alerts for the CIS 5.2.x administrative operations (policy assignments, NSG changes, SQL firewall changes, security solutions). Without them, control-plane tampering goes unnoticed.

• Security

  Classic co-administrators still present

  Legacy classic Co-Administrators on the subscription. Full, unscoped control predating RBAC, invisible to most role reviews. Microsoft retired classic admin roles in 2024.

• Security

  Cognitive/OpenAI accounts: keys + public network

  Cognitive Services / Azure OpenAI accounts that accept API-key authentication AND allow public network access. One leaked key means unmetered, unattributed usage of the account (and for OpenAI, of your model quota) from anywhere.

• Security

  Container registries allowing anonymous pull

  Registries with anonymous (unauthenticated) pull enabled. Every image, including internal ones with baked-in secrets, is world-readable.

• Security

  Container registries allowing image export

  Premium registries with the export policy enabled. Export lets images be copied off-platform with az acr import/transfer - a data-exfiltration path for a network-locked registry.

• Security

  Container registries with admin user enabled

  Registries with the built-in admin account on. A single shared username/password with full push/pull rights and no identity audit trail.

• Security

  Cosmos DB key-based auth enabled

  Cosmos DB accounts that still accept primary/secondary key authentication. AAD-only auth (disableLocalAuth) removes the shared-secret attack surface.

• Security

  Cosmos DB open to all networks

  Cosmos DB accounts with public network access enabled and no IP firewall or VNet rules. Any Internet host can reach the endpoint, gated only by keys/AAD.

• Security

  Custom roles with wildcard (*) actions

  Custom RBAC roles granting '*' actions with subscription-wide assignable scope. Owner-equivalent roles hiding under custom names (CIS Azure 1.x).

• Security

  Defender for SQL not enabled (paid feature)

  Logical servers without Defender for SQL (vulnerability assessment + threat protection). Honest framing: enabling it COSTS ~$15/server/month. This is a posture gap, not savings.

• Security

  Flexible servers not requiring TLS

  PostgreSQL/MySQL flexible servers with require_secure_transport OFF. Clients may connect over unencrypted channels.

• Security

  Flexible servers with public network access

  PostgreSQL/MySQL flexible servers reachable over the public endpoint. VNet-integrated (private access) deployment removes the Internet-facing surface.

• Security

  Front Door Standard/Premium without a WAF policy

  Front Door Standard/Premium profiles with no WAF security policy associated. The CDN front end has no application-layer filtering in front of the origins.

• Security opt-in

  Guest user with privileged role

  Guest / external directory users holding Owner, Contributor, or User Access Administrator. Privileged access for an outside identity.

• Security

  Key Vaults open to all networks

  Vaults with public network access enabled and no default-deny network ACL. Reachable from any Internet address.

• Security

  Key Vaults with firewall default-action Allow

  Key Vaults that have network ACL rules configured but leave the default action at Allow - the firewall rules are written yet every network can still reach the vault.

• Security

  Key Vaults without diagnostic settings

  Key Vaults with no diagnostic settings configured. Vault audit events (secret/key access, policy changes) are not exported to Log Analytics, storage, or Event Hub, so there is no audit trail of who read what.

• Security

  Key Vaults without purge protection

  Vaults where purge protection is off. Soft-deleted secrets can still be force-purged before the retention window ends.

• Security

  Key Vaults without soft delete

  Vaults with soft delete disabled. Deleted keys/secrets are gone instantly and irrecoverably.

• Security

  Managed HSM pools (cost review)

  Every Managed HSM pool, flagged for awareness: each one is a ~$2,300+/month fixed cost. No savings are claimed. Pools serving real compliance requirements are money well spent.

• Security

  Managed HSM pools in non-prod

  Key Vault Managed HSM pools whose name/tags look non-production. A pool bills ~$2,300+/month from provisioning until purge. Dev/test workloads almost never need a dedicated FIPS 140-3 Level 3 HSM.

• Security

  Managed disks on platform-managed keys only

  Attached managed disks encrypted with the platform-managed key only (no disk-encryption-set / customer-managed key). Some data-classification policies require CMK. Informational.

• Security

  Managed disks reachable from the internet

  Managed disks with networkAccessPolicy AllowAll and public network access enabled. Disk export/import SAS URLs are then reachable from the internet rather than over Private Link.

• Security

  Messaging namespaces with SAS auth on public endpoints

  Event Hubs / Service Bus namespaces that are publicly reachable AND still accept shared-access-signature (local) auth. Informational. SAS is common, but AAD-only is the hardened posture.

• Security opt-in

  NSG with no matched traffic

  Network security groups whose traffic metric is flat-zero over the window. Their rules are matching nothing and may be stale.

• Security

  NSGs allowing ALL inbound from anywhere

  NSG rules allowing inbound on every port from any source. The NSG is effectively disabled.

• Security

  NSGs exposing SSH/RDP to the Internet

  NSG rules allowing inbound 22 (SSH) or 3389 (RDP) from any source. The #1 brute-force entry point on Azure.

• Security

  NSGs exposing database ports to the Internet

  NSG rules allowing inbound database ports (1433/3306/5432/6379/27017) from any source. Databases should never face the raw Internet. Complements AZ_NSG_OPEN_MGMT_PORTS.

• Security

  No Defender security contact configured

  Subscriptions without a Microsoft Defender for Cloud security contact. Security alerts have nowhere to go (CIS Azure 2.x).

• Security

  No SAS expiration policy (CIS)

  Accounts allowing shared-key access without a SAS expiration policy. Nothing nudges clients away from years-long SAS tokens (CIS Azure 3.x).

• Security opt-in

  Orphaned role assignment (deleted principal)

  RBAC role assignments whose principal no longer exists in the directory. Stale grants that should be cleaned up.

• Security

  Premium registries publicly open with no IP rules

  Premium registries (the only tier supporting network rules) that are publicly reachable with no IP restrictions.

• Security

  Premium registries without quarantine policy

  Premium registries with the image quarantine policy disabled. Pushed images are pullable before any scan passes. Informational: quarantine is still a preview feature.

• Security

  Private-linked Web Apps still open to the internet

  Web Apps that have private endpoints wired up but still have public network access enabled - the intended-private app is also reachable from the internet.

• Security

  Prod VNets without DDoS Network Protection

  Production-looking VNets without DDoS Network Protection. Honest framing: enabling it COSTS ~$2,944/month per plan. Weigh it against exposure; basic infrastructure protection is already free.

• Security

  Recovery Services vaults with soft delete disabled

  Backup vaults with soft delete turned off. Soft delete is the ransomware-recovery safety net - it keeps deleted backups recoverable for 14 days even after a malicious delete.

• Security

  Redis caches with the non-SSL port open

  Redis caches accepting plaintext connections on port 6379. Credentials and cached data transit unencrypted.

• Security

  SQL auditing retention under 90 days

  SQL servers with auditing enabled but storage retention set below 90 days (CIS 4.1.6 wants >= 90; 0 means unlimited and is fine). Short retention means the trail is gone before most incidents are even noticed.

• Security

  SQL server firewall open to the Internet

  SQL server firewall rules spanning 0.0.0.0-255.255.255.255. The entire IPv4 Internet can reach the SQL endpoint.

• Security

  SQL servers accepting TLS < 1.2

  SQL servers whose minimal TLS version is 1.0 or 1.1. Deprecated protocols vulnerable to downgrade attacks.

• Security

  SQL servers allowing SQL logins

  SQL servers without Entra-only authentication. Classic SQL logins (password-based, non-MFA) still work. Informational.

• Security

  SQL servers using service-managed TDE keys

  SQL servers whose Transparent Data Encryption protector is a service-managed key rather than a customer-managed (BYOK) Key Vault key. Some policies mandate BYOK. Informational.

• Security

  SQL servers with public network access

  SQL servers whose public endpoint is enabled. Private Link + disabled public access removes the Internet-facing surface.

• Security

  SQL servers without auditing

  SQL servers whose server-level auditing is disabled. No trail of logins, queries, or permission changes (CIS 4.1.1).

• Security

  SQL servers without recurring vulnerability scans

  SQL servers where Vulnerability Assessment has no recurring scans configured. Without them the Defender for SQL posture baseline is never re-evaluated.

• Security opt-in

  Security recommendations (Azure Advisor)

  Microsoft Advisor security-posture recommendations.

• Security opt-in

  Stale app / SP credentials

  App registrations or service principals with expired (or imminently expiring) secrets or certificates.

• Security

  Standard public IPs without DDoS Network Protection

  Attached Standard public IPs with no DDoS protection mode set. Internet-facing endpoints without DDoS Network Protection rely on the platform's basic, best-effort mitigation only.

• Security opt-in

  Storage account keys not rotated

  Storage accounts with no key-regeneration event in the Activity-Log window. Shared keys may be long-lived and over-exposed.

• Security

  Storage accounts accepting HTTP

  Storage accounts with supportsHttpsTrafficOnly disabled. Data and SAS tokens can transit in cleartext.

• Security

  Storage accounts allowing cross-tenant replication

  Accounts with cross-tenant object replication explicitly enabled. Data can be replicated to a storage account in a different Entra tenant.

• Security

  Storage accounts allowing old TLS

  Storage accounts whose minimumTlsVersion is below TLS 1.2. TLS 1.0/1.1 are deprecated industry-wide.

• Security

  Storage accounts allowing public blob access

  Storage accounts with allowBlobPublicAccess enabled. Any container can be flipped to anonymous public access.

• Security

  Storage accounts allowing shared-key auth

  Accounts accepting account-key (shared key) authorization. CIS recommends Entra ID-only auth. Informational. Shared key is still the Azure default and widely used.

• Security

  Storage accounts with SFTP local users enabled

  Storage accounts with the local-users (SFTP) feature on. Local users authenticate with shared SSH keys or passwords, bypassing Entra ID and its audit trail.

• Security

  Storage accounts with network default-action Allow

  Storage accounts whose network ACL default action is Allow while IP/VNet rules exist - the rules are written but the open default makes them moot, so any network can reach the data.

• Security

  Storage accounts without infrastructure encryption

  Storage accounts where requireInfrastructureEncryption is off - data is encrypted once at rest, not double-encrypted, which some regulated workloads require. Set at creation time only.

• Security

  Too many Owners at subscription scope

  Subscriptions with more than 3 Owner role assignments at subscription scope (CIS 1.24). Every extra Owner is a full-takeover blast radius for one phished credential.

• Security

  VMs on legacy unmanaged disks

  VMs whose OS/data disks are legacy page blobs in a storage account instead of managed disks. No SSE-by-default guarantees, no per-disk RBAC, retired feature path.

• Security

  VMs with a public IP on the NIC

  Public IPs bound directly to VM NICs. Direct exposure bypasses load balancers/firewalls and gives every such VM an Internet attack surface. Informational.

• Security

  VMs without Trusted Launch boot integrity

  VMs with Secure Boot or vTPM disabled. Trusted Launch protects against boot-kit and rootkit tampering; both flags should be on for Gen2 VMs that support it.

• Security

  VMs without encryption-at-host

  Running VMs without encryptionAtHost. Server-side encryption already protects managed disks at rest. This is the extra host-cache/temp-disk layer. Informational.

• Security

  WAF-SKU App Gateways not blocking attacks

  WAF-SKU Application Gateways whose firewall is absent, disabled, or in Detection-only mode. Paying the WAF price while attacks pass through unblocked.

• Security

  Web apps accepting TLS < 1.2

  Web/Function apps whose minimum TLS version is 1.0 or 1.1 (both deprecated).

• Security

  Web apps allowing plain FTP deploys

  Web/Function apps with ftpsState=AllAllowed. Deployment credentials can transit over unencrypted FTP.

• Security

  Web apps with remote debugging on

  Web/Function apps with remote debugging enabled. An interactive debugger port exposed on a production endpoint.

• Security

  Web apps without HTTPS-only

  Web/Function apps still serving plain HTTP. HTTPS-only redirects all HTTP traffic and is free to enable.

• Security

  Web/Function Apps on end-of-life runtimes

  Sites running runtime stacks past end-of-life (Python <= 3.9, Node <= 18, PHP <= 8.1, .NET Core/.NET 5-7, Ruby). EOL runtimes get no security patches, and App Service stops servicing the underlying images.

• Security

  Web/Function Apps without client-certificate enforcement

  App Service sites with incoming client certificates not required. Where mutual TLS is expected, this leaves the app accepting any caller the front end lets through. Informational.

• Storage

  Backups of VMs that no longer exist

  Protected VM backup items whose source VM is gone from the subscription. The backup data keeps billing per GB until protection is stopped and data deleted.

• Storage

  Full (non-incremental) snapshots

  Snapshots created without the incremental flag bill the full disk size; incremental snapshots bill only changed data.

• Storage

  Geo-redundant backup storage on non-prod vaults

  Recovery Services vaults with GeoRedundant backup storage whose name/tags look non-production. LRS halves the per-GB backup storage rate for data that doesn't need cross-region recovery.

• Storage

  Geo-redundant storage accounts in non-prod

  GRS/RA-GRS/GZRS/RA-GZRS storage accounts whose name/tags look non-production. Geo redundancy costs 2-3x LRS per GB, one of the quietest recurring overspends on Azure.

• Storage

  Legacy GPv1 storage accounts

  General-purpose v1 storage accounts. GPv1 lacks access tiering (Cool/Cold/Archive) and lifecycle management. Upgrading to GPv2 is free and unlocks cheaper tiers.

• Storage

  Old disk snapshots

  Disk snapshots older than 90 days. Forgotten snapshots accumulate silently at per-GB rates.

• Storage

  Orphaned resources across subscriptions

  Aggregates unattached disks, public IPs, and NICs found across every subscription in the management group into a single fleet-wide waste figure.

• Storage

  Premium disks on deallocated VMs

  Premium SSD disks attached to deallocated VMs. Disk billing continues at the Premium rate while the VM is off. Standard SSD costs ~45% less for parked workloads.

• Storage uses metrics

  Premium file shares provisioned above used capacity

  Premium (FileStorage) accounts whose provisioned share capacity is far above the bytes actually stored. Premium Azure Files bills on provisioned GiB, not used GiB. Every over-provisioned gigabyte is paid for whether written to or not.

• Storage

  Storage accounts without lifecycle policies

  Hot-tier storage accounts with no lifecycle management policy. Aging blobs never tier down to Cool/Archive automatically.

• Storage

  Unattached managed disks

  Managed disks in 'Unattached' state. Azure bills the full provisioned size every month whether or not a VM uses it.

Checks marked opt-in use a paid or billing-data cloud API and never run unless you switch them on. A default scan uses only free APIs.