CloudFinOpsPro
Azure waste

Web PubSub services nobody connects to

A real-time messaging service with nobody connected
The agent reports this
Reversible
Why it happens

You pay per unit per day whether or not anyone connects. An instance set up for a trial and forgotten keeps billing.

Web PubSub bills per unit per day whether or not a client ever connects. An instance left behind after a prototype keeps charging for capacity nobody reaches.

Paste this into Resource Graph Explorer in the Azure portal.

resources
| where type =~ 'microsoft.signalrservice/webpubsub'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
// This query does NOT apply these policy defaults, which the check also requires:
//   maxConnections 0, windowHours 336
// They are measured from Azure Monitor metrics, which Resource Graph cannot read, so this lists
// candidates and the agent decides which of them qualify.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
// Free bills nothing, so it is not waste.
| where tostring(sku.tier) in~ ('Standard', 'Premium')
| project name, resourceGroup, location,
          tier = tostring(sku.tier),
          skuName = tostring(sku.name),
          units = toint(sku.capacity)
| order by units desc

The unit meter is published per DAY, not per hour: Standard is $1.61 a day, so $48.97 a month per unit, and reading it as hourly would be twenty-four times too large. The Standard sku also carries a message meter priced per million and a zero-priced free unit meter, so the rate is matched on the exact meter name. Web PubSub and SignalR publish the same numbers today and are separate services, so the agent prices this one from its own, and the connection metric is TotalConnectionCount rather than the ConnectionCount its sibling publishes.

Applies to microsoft.signalrservice/webpubsub
What the agent does about it

A Standard or Premium Web PubSub instance whose highest concurrent connection count across the window was at or below the threshold, while its units bill every day.

It will not fix this one

It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.

See what it would changeAll 95 checks
Related checks

App Service plan with no apps

A paid App Service plan hosting no applications.

App Service Environment with no plans

An App Service Environment hosting no App Service plans.

App Service plan larger than its sustained demand

A plan whose sustained CPU and memory sit far below the tier it is provisioned in.