Azure waste

App Service plans with no apps

A web hosting plan with no websites on it
The agent fixes this
Why it happens

The plan bills for its capacity whether or not anything runs on it. Apps get deleted and the plan underneath is missed.

A plan bills for its tier whether or not any app runs on it. Apps get deleted and the plan underneath them is missed.

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.web/serverfarms'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where properties.numberOfSites == 0
| where sku.tier !in~ ('Free','Shared')
| project name, resourceGroup, location,
          sku = tostring(sku.name),
          tier = tostring(sku.tier)

Free and Shared tiers cost nothing, so they are filtered out.

Applies to microsoft.web/serverfarms
What the agent does about it

A paid App Service plan hosting no applications.

And what stops it

It has to see the same thing on three consecutive runs before it will act, it stays away from anything a person changed recently, and it will not touch a resource unless you tagged it non-production. Untagged counts as production. Every refusal is written down with the rule that caused it.