Front Door profile with no endpoints

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.cdn/profiles'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where tostring(sku.name) has 'AzureFrontDoor'
| extend profileId = tolower(id)
| join kind=leftouter (
    resources
    | where type =~ 'microsoft.cdn/profiles/afdendpoints'
    | extend profileId = substring(tolower(id), 0, indexof(tolower(id), '/afdendpoints'))
    | summarize endpoints = count() by profileId
  ) on profileId
| extend endpoints = coalesce(endpoints, 0)
| where endpoints == 0
| project name, resourceGroup, location, sku = tostring(sku.name), endpoints, environment = cfopEnv

A profile with no endpoints routes nothing while still billing its tier, so counting the endpoints is the whole check and a query that merely listed profiles would report every one. microsoft.cdn/profiles/afdendpoints is indexed by Resource Graph, verified rather than assumed, so the count can be done here; the parent id is derived by cutting each endpoint id at /afdEndpoints, lower-cased on both sides because resource ids do not agree on casing. The sku filter keeps Front Door profiles and excludes classic CDN profiles under the same resource type. The join technique is proven on real data rather than assumed: run against the reference subscription's Cognitive Services accounts and the one project inside them, the identical shape attributed that child to its own parent and reported zero for the other two accounts. What is not proven is its selection on real Front Door profiles, because that subscription owns none.