Skip to main content
idle · azure

Standard Azure Load Balancers with an empty backend pool and no traffic for 30 days

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags a Standard Azure Load Balancer whose backend pools have no members and whose `ByteCount` stays under 100 KB, with `PacketCount` under 1,000 when reported, across 30 days. With nothing behind it the load balancer serves no one, yet each configured load-balancing or outbound rule keeps billing by the hour.

Signal and threshold

How ZopNight evaluates Standard Azure Load Balancers with an empty backend pool and no traffic for 30 days.
Field Value
Rule IDsRC-1362
Categoryidle
Severitymedium
MetricByteCount, PacketCount
Thresholdempty backend pool, ByteCount < 100 KB, PacketCount < 1,000
Evaluation window30d
SourceZopNight
Permissions usedMicrosoft.Network/loadBalancers/read · Microsoft.Network/loadBalancers/backendAddressPools/read · Microsoft.Insights/Metrics/Read

What a Standard Load Balancer bills for

Load Balancer pricing charges a Standard Load Balancer for the load-balancing and outbound rules it has configured (the first 5 rules at one rate, additional rules each), plus data processed. Inbound NAT rules do not count toward the rule total, and Microsoft’s pricing FAQ confirms there is no hourly charge when no rules are configured. A partial hour is billed as a full hour.

So an empty pool is not free: the rules that pointed at it still bill every hour. And since Basic Load Balancer was retired on September 30, 2025, every load balancer you still run is effectively a Standard one.

Finding load balancers with empty pools

Terminal window
az network lb list --query "[].{name:name, rg:resourceGroup, sku:sku.name}" -o table
az network lb address-pool list --resource-group my-rg --lb-name my-lb \
--query "[].{pool:name, nics:length(backendIPConfigurations || \`[]\`), ips:length(loadBalancerBackendAddresses || \`[]\`)}" \
-o table
az monitor metrics list --resource <lb-resource-id> \
--metric ByteCount PacketCount --offset 30d --interval PT24H --aggregation Total Maximum

Zero NICs and zero IP addresses in every pool, with near-zero bytes, is the pattern.

Conditions for an empty, silent load balancer

  1. The SKU is not Basic.
  2. No backend pool has any member.
  3. The ByteCount series is present, covers at least 30 days, and stays below 100 KB on both average and peak. That floor allows for health probe and keep-alive noise.
  4. When PacketCount is reported, it stays below 1,000 on both average and peak.
  5. The load balancer has a known monthly cost above zero.

Load balancers ZopNight skips

Load balancers named kubernetes or containing kubernetes-internal are skipped: AKS creates and manages those, and their pools change as services come and go. Any pool member, any traffic above the floors, a missing byte series or less than 30 days of data also means no finding. Health probe availability, the DipAvailability metric, is shown for context but never decides the result.

Saving from removing the load balancer

Terminal window
saving = current monthly cost of the load balancer (rules plus data processed)
cost after fix = 0

Cleaning up an empty load balancer

  1. Check whether the backend VMs were deleted, deallocated or moved to another load balancer, and whether any DNS record or firewall rule still uses its frontend IP.
  2. Delete it: az network lb delete --resource-group my-rg --name my-lb.
  3. Delete or reuse its public IP addresses, which are billed separately.
  4. Remove leftover health probes and rules from any infrastructure code so the next deploy does not recreate it.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·