Azure waste
Private endpoints whose target is gone
A private connection to something that is gone
The agent reports this
Why it happens
Deleting the service does not delete the connection to it. The connection keeps billing while pointing at nothing.
A private endpoint outlives the resource it pointed at. The connection sits rejected or disconnected and the endpoint keeps billing.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.network/privateendpoints'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| mv-expand conn = properties.privateLinkServiceConnections
| extend state = tostring(conn.properties.privateLinkServiceConnectionState.status)
| where state !~ 'Approved'
| project name, resourceGroup, location, state,
target = tostring(conn.properties.privateLinkServiceId)A cross-subscription target may look unresolvable when it is fine, so confirm the target really is gone.
Applies to microsoft.network/privateendpointsWhat the agent does about it
A private endpoint whose upstream connection is not Approved, or whose target resource cannot be found in the estate.
It will not fix this one
It reports this and takes no action. A check only earns the right to change something once the action behind it can re-read live state before it fires and knows the way back.