Azure Firewall that has processed no traffic
A firewall whose data processed, network rule hits and application rule hits were all zero for the whole window.
Why it happens
Azure Firewall bills a fixed hourly deployment fee whether or not traffic crosses it: about $912 a month on Standard and $1,277 on Premium. A firewall that processed no bytes and matched no rule over the window is paying that fee for nothing. Common after a workload is migrated or a spoke network is decommissioned and the hub firewall is left running.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.network/azurefirewalls'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| project name, resourceGroup, location,
tier = tostring(properties.sku.tier)Traffic is measured by Azure Monitor, not Resource Graph, so this lists the firewalls and their tier rather than deciding. For each one, check DataProcessed, NetworkRuleHit and ApplicationRuleHit over the same window: the check reports a firewall only when all three are a measured zero. A firewall that only ever denies traffic still registers rule hits, which is why bytes alone are not enough. The deployment meter is charged per hour regardless: about $912 a month on Standard, $1,277 on Premium, $288 on Basic.
Applies to microsoft.network/azurefirewallsWhat the agent does about it
A firewall whose data processed, network rule hits and application rule hits were all zero for the whole window.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
Azure Firewall Premium without Premium-only features configured
A firewall on Premium where no Premium-only feature (IDPS, TLS inspection, URL filtering, web categories) is enabled in the attached policy.
Unassociated static public IP
A reserved static address attached to nothing.
NAT gateway with no subnet
A NAT gateway associated with no subnet, billing its full hourly rate.