CloudFinOpsPro
Azure waste

Application gateways with no backend targets

A traffic router pointing at nothing
The agent fixes this
Why it happens

Gateways bill a fixed hourly rate whether or not traffic flows. This one has no destinations left behind it.

A gateway is a front door billing a fixed hourly rate whether or not it routes anything. Pools get emptied during a migration and the gateway is left behind.

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.network/applicationgateways'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend pools = properties.backendAddressPools
| extend populated = array_length(pools)
| project name, resourceGroup, location,
          tier = tostring(properties.sku.tier),
          poolCount = populated

Expand backendAddressPools to check whether the pools actually reference targets. An empty pool still counts as a pool.

Applies to microsoft.network/applicationgateways
What the agent does about it

A gateway whose backend pools all reference nothing.

And what stops it

It has to see the same thing on three consecutive runs before it will act, it stays away from anything a person changed recently, and it will not touch a resource unless you tagged it non-production. Untagged counts as production. Every refusal is written down with the rule that caused it.

See what it would changeAll 79 checks
Related checks

Unassociated static public IP

A reserved static address attached to nothing.

NAT gateway with no subnet

A NAT gateway associated with no subnet, billing its full hourly rate.

ExpressRoute circuit billing with no carrier connection

An ExpressRoute circuit whose connectivity provider has not provisioned it, so it bills the full monthly port fee while carrying no traffic.