Virtual network peerings that are not Connected, usually left Disconnected

How a peering ends up disconnected

A peering is a pair of links, one created in each virtual network. The peering management guide describes the states: the first link shows Initiated, and both become Connected once the second link exists. The virtual network FAQ explains the failure case: a peering goes into a Disconnected state when one of its links is deleted, and to re-establish it you must delete the remaining link and re-create both.

So a Disconnected link is a half-peering. Traffic cannot flow over it, and it will not recover on its own. It usually means the remote network was deleted or rebuilt, and nobody cleaned up this end.

Finding disconnected links

Peerings are listed per virtual network. Loop over the networks and show any link that is not Connected:

az network vnet list --query "[].{name:name, group:resourceGroup}" -o tsv |
while read -r vnet rg; do
  az network vnet peering list --resource-group "$rg" --vnet-name "$vnet" \
    --query "[?peeringState!='Connected'].{vnet:'$vnet', name:name, state:peeringState, remote:remoteVirtualNetwork.id}" -o table
done

The check behind the finding

ZopNight reads each peering’s peeringState during its scan and records whether the link is connected. The rule fires when that record says the peering is anything other than Connected. Disconnected is the usual case, but a link left at Initiated because the second side was never created is not established either, so it is reported the same way. A Connected peering, or one whose state could not be read, is never reported. Customer tags are not used as evidence.

Why the finding shows no saving

The virtual network pricing page charges peering on ingress and egress data at both ends, and the FAQ adds that there is no charge for creating a peering connection. A link that carries no traffic therefore costs nothing, and ZopNight reports this finding with $0 current cost and $0 saving. It never reads a price for it.

The value is clarity: a disconnected link looks like connectivity on a diagram but provides none, and it blocks re-creating a working peering until it is removed.

Removing or rebuilding the peering

1. Open the virtual network’s Peerings blade and confirm the state is Disconnected, or Initiated with no matching link on the remote side.
2. Check whether the remote network still exists and whether connectivity to it is still wanted.
3. Delete the stale link: az network vnet peering delete --resource-group <rg> --vnet-name <vnet> --name <peering>.
4. If the two networks should talk, create the peering again from both sides so both links show Connected.