Azure waste
Azure Bastion hosts nobody connects to
A remote access service nobody logs in through
The agent reports this
Why it happens
It bills every hour it exists, not per session. Commonly set up for one migration and left running.
Bastion bills a flat hourly rate for being deployed. It gets stood up for one migration and never removed.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.network/bastionhosts'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| project name, resourceGroup, location,
sku = tostring(sku.name)Session counts come from Azure Monitor, not Resource Graph. This lists the hosts so you can check each one's session metric.
Applies to microsoft.network/bastionhostsWhat the agent does about it
A Bastion host with no session activity over the evaluation window.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.