VPN gateway with nothing connected to it
A VPN gateway with no connections attached and no point-to-site clients, billing its full hourly rate.
Why it happens
A VPN gateway bills a flat hourly rate for as long as it exists, whether or not any traffic crosses it: a VpnGw1 is about $0.19 an hour, roughly $138.70 a month, and a Basic gateway about $26 a month. It cannot be stopped or deallocated the way a VM can, so the only way to stop the charge is to delete it, and recreating one takes around 45 minutes and does not keep the old public IP. The rule reports a gateway only when nothing can be using it: no connection object references it on either end, which rules out site-to-site and VNet-to-VNet traffic structurally, and where point-to-site is configured the point-to-site connection count must also total zero across the window. A gateway that does have connections attached is never reported even if no traffic crossed it this week, because a tunnel to a partner or a disaster-recovery site is legitimately provisioned whether or not it was busy. ExpressRoute gateways share this resource type and are deliberately excluded, since deleting one severs a contracted circuit.
What the agent does about it
A VPN gateway with no connections attached and no point-to-site clients, billing its full hourly rate.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.
Related checks
ExpressRoute gateway with no circuit connected to it
An ExpressRoute gateway that no connection object references, billing its full hourly rate with no circuit attached to it.
Unassociated static public IP
A reserved static address attached to nothing.
NAT gateway with no subnet
A NAT gateway associated with no subnet, billing its full hourly rate.