# Azure Public IP Not Associated

> Detached Standard-SKU public IPs bill an idle hourly charge of roughly $3–4 per month, forever. ZopNight fires only when the discoverer's ipConfiguration check shows no attachment and the SKU metadata reads Standard, because a Basic IP is free when idle and flagging one would fabricate a saving.

Source: https://zop.dev/integrations/azure/recommendations/azure-public-ip-not-associated
Updated: 2026-08-19

---

## The address that outlives its VM

Deleting a VM, load balancer, or gateway in Azure leaves its public IP behind as an
independent resource. A Standard-SKU address then bills its idle hourly rate indefinitely.
The amount is small per address, but detached IPs accumulate in fleets, and each one also
represents a reserved piece of your network identity that nobody is watching.

## Attachment read from the API, not from tags

The signal is the discoverer's reading of the address's ipConfiguration property: an
unassociated IP has no attachment to any NIC, load balancer frontend, or gateway. The rule
is metadata-only on purpose: the prior tag-based fallback was removed because a
customer-controlled tag must never drive an irreversible delete. Absent or ambiguous
association state fails closed.

## The Basic-SKU trap in the pricing data

Azure's retail meter for idle public IPs is keyed to the Standard SKU; Basic addresses are
free while idle. Pricing a Basic IP with the Standard rate would invent a charge that does
not exist, so the rule fires only when the discoverer captured the SKU as Standard.
Anything else, including a missing SKU, abstains. With Basic public IPs retired from sale,
the Standard-only gate covers the fleet that actually bills.

## Sweep a subscription for detached addresses

```bash
az network public-ip list --query \
  "[?ipConfiguration==null && sku.name=='Standard'].{name:name, rg:resourceGroup, ip:ipAddress}" \
  -o table
```

## Before releasing an address

Write the literal IP down first. DNS records, firewall allowlists at partner companies,
and mobile-app configurations sometimes pin that exact address, and a release hands it
back to the Azure pool. If the address must survive, attach it to the replacement resource
instead of deleting it. Otherwise delete; the charge stops immediately.

## Quiet paths

Associated addresses, Basic or unknown SKUs, and addresses without a priced cost all pass
without a finding. Reader alone is enough to reproduce the check. No metrics are involved,
so Monitoring Reader is not needed for this one.