Standard public IPs billing idle with nothing attached
What does ZopNight detect here?
Detached Standard-SKU public IPs bill an idle hourly charge of roughly $3–4 per month, forever. ZopNight fires only when the discoverer's ipConfiguration check shows no attachment and the SKU metadata reads Standard, because a Basic IP is free when idle and flagging one would fabricate a saving.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1363 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Source | public_ip_idle.go |
Where it applies
The address that outlives its VM
Deleting a VM, load balancer, or gateway in Azure leaves its public IP behind as an independent resource. A Standard-SKU address then bills its idle hourly rate indefinitely. The amount is small per address, but detached IPs accumulate in fleets, and each one also represents a reserved piece of your network identity that nobody is watching.
Attachment read from the API, not from tags
The signal is the discoverer’s reading of the address’s ipConfiguration property: an unassociated IP has no attachment to any NIC, load balancer frontend, or gateway. The rule is metadata-only on purpose: the prior tag-based fallback was removed because a customer-controlled tag must never drive an irreversible delete. Absent or ambiguous association state fails closed.
The Basic-SKU trap in the pricing data
Azure’s retail meter for idle public IPs is keyed to the Standard SKU; Basic addresses are free while idle. Pricing a Basic IP with the Standard rate would invent a charge that does not exist, so the rule fires only when the discoverer captured the SKU as Standard. Anything else, including a missing SKU, abstains. With Basic public IPs retired from sale, the Standard-only gate covers the fleet that actually bills.
Sweep a subscription for detached addresses
az network public-ip list --query \ "[?ipConfiguration==null && sku.name=='Standard'].{name:name, rg:resourceGroup, ip:ipAddress}" \ -o tableBefore releasing an address
Write the literal IP down first. DNS records, firewall allowlists at partner companies, and mobile-app configurations sometimes pin that exact address, and a release hands it back to the Azure pool. If the address must survive, attach it to the replacement resource instead of deleting it. Otherwise delete; the charge stops immediately.
Quiet paths
Associated addresses, Basic or unknown SKUs, and addresses without a priced cost all pass without a finding. Reader alone is enough to reproduce the check. No metrics are involved, so Monitoring Reader is not needed for this one.