Azure waste
Load balancers with no backend pool members
A load balancer with nothing behind it
The agent reports this
Why it happens
It charges by the hour to spread traffic across servers. There are no servers left to spread it across.
A Standard load balancer bills whether or not anything sits behind it. Instances get removed and the balancer stays.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.network/loadbalancers'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where sku.name =~ 'Standard'
| extend pools = array_length(coalesce(properties.backendAddressPools, dynamic([])))
| extend rules = array_length(coalesce(properties.loadBalancingRules, dynamic([])))
| where pools == 0 or rules == 0
| project name, resourceGroup, location, pools, rulesBasic tier load balancers are free, so this filters to Standard where the charge is real.
Applies to microsoft.network/loadbalancersWhat the agent does about it
A Standard Load Balancer whose backend pools are all empty, or which has no load-balancing rules at all.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.