Unassociated public IP addresses in Azure
A reserved internet address attached to nothing
Why it happens
Delete a server and its address often stays behind. Azure charges to hold it whether anything answers on it or not.
The classic orphan. A VM or load balancer is deleted, its address is not, and a reserved static IP bills every hour for being reserved.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.network/publicipaddresses'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where isnull(properties.ipConfiguration) and isnull(properties.natGateway)
| where properties.publicIPAllocationMethod =~ 'Static'
| project name, resourceGroup, location,
sku = tostring(sku.name),
ip = tostring(properties.ipAddress)Only static addresses cost anything when unassociated. Releasing one means losing it, so check nothing external has it allow-listed.
Applies to microsoft.network/publicipaddressesWhat the agent does about it
A reserved static address attached to nothing.
And what stops it
It has to see the same thing on three consecutive runs before it will act, it stays away from anything a person changed recently, and it will not touch a resource unless you tagged it non-production. Untagged counts as production. Every refusal is written down with the rule that caused it.
Related checks
NAT gateway with no subnet
A NAT gateway associated with no subnet, billing its full hourly rate.
Application gateway with no backend targets
A gateway whose backend pools all reference nothing.
ExpressRoute circuit billing with no carrier connection
An ExpressRoute circuit whose connectivity provider has not provisioned it, so it bills the full monthly port fee while carrying no traffic.