Idle virtual machines in Azure
A server that is switched on but doing nothing
Why it happens
It still bills the full hourly rate. Shutting it down stops the charge and keeps the disks, so it starts again exactly as it was.
A VM gets built for a project, the project ends, and nobody deletes the machine. It keeps running and keeps billing at the full compute rate whether or not anything connects to it.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.compute/virtualmachines'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| extend power = tostring(properties.extended.instanceView.powerState.code)
| where power == 'PowerState/running'
| project name, resourceGroup, location,
size = tostring(properties.hardwareProfile.vmSize)Resource Graph shows which machines are running. It holds no metrics, so it cannot apply either part that decides: the check requires the average CPU below its threshold AND the average network bytes below a separate one, so a machine with a quiet processor that is still moving traffic appears here and is absent from the findings. Confirm both in Azure Monitor before acting.
Applies to microsoft.compute/virtualmachinesWhat the agent does about it
A running VM whose CPU and network have been near zero for the whole window.
And what stops it
It has to see the same thing on three consecutive runs before it will act, it stays away from anything a person changed recently, and it will not touch a resource unless you tagged it non-production. Untagged counts as production. Every refusal is written down with the rule that caused it.