Azure waste

Unused App Service deployment slots

A staging copy of a site nobody visits
The agent reports this
Why it happens

Staging copies do not bill directly, but they take up room on the plan, and that room is often why the plan is on a pricier tier.

Slots are created for a blue-green rollout and left in place. They do not bill separately but they consume the plan capacity that forced you onto a higher tier.

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.web/sites/slots'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| project slot = name, resourceGroup, location,
          state = tostring(properties.state),
          plan = tostring(properties.serverFarmId)

Check the Requests metric per slot. A slot with no traffic for months is usually finished with.

Applies to microsoft.web/sites/slots
What the agent does about it

A deployment slot that has been idle long enough to no longer justify the plan tier that hosts it.

It will not fix this one

It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.