Skip to main content
idle · azure

Application Gateways with no requests and no client connections

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

Application Gateway bills per hour plus capacity units even at zero traffic, so ZopNight examines TotalRequests and CurrentConnections over 30 days and flags the gateway when every present series averages 0 with at least 7 days of history behind it. Empty backend pools are the usual root cause.

Signal and threshold

How ZopNight evaluates Application Gateways with no requests and no client connections.
Field Value
Rule IDsRC-272
Categoryidle
Severitymedium
Metricnone — pure configuration read
Sourceappgateway_idle.go

Layer-7 front doors that nobody walks through

An Application Gateway is typically the paid front door to something, until the something moves behind Front Door, gets rebuilt on Container Apps, or is simply deleted while the gateway stays. The hourly charge and provisioned capacity units keep billing either way. ZopNight reads two Azure Monitor series on the gateway: TotalRequests (traffic served) and CurrentConnections (clients attached). A positive average on either one proves the gateway is still in the serving path, and the evaluation stops there.

Both counters at zero, with history to back it

Whichever of the two series are present must average 0, and each present series needs at least 7 days of trustworthy coverage. A gateway whose diagnostics were enabled on Tuesday cannot be condemned by Friday. When neither series exists at all, the rule abstains: no telemetry is a data gap, not evidence.

Reproduce the traffic check

Terminal window
az monitor metrics list \
--resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/applicationGateways/<name>" \
--metric TotalRequests CurrentConnections \
--interval PT1H --offset 30d --aggregation Average

While you are there, look at the backend pools; a gateway with zero traffic usually has backends that were deallocated or deleted months ago:

Terminal window
az network application-gateway show -n <name> -g <rg> \
--query "backendAddressPools[].backendAddresses" -o json

What a delete takes with it

Removing the gateway ends the hourly and capacity-unit charges. Its public IP address is a separate resource that survives and keeps billing, so plan to delete or reassign it in the same change, along with WAF policies attached to nothing.

Reasons the rule holds its fire

Any request or connection activity, both metric series missing, shallow coverage on a present series, or an unpriced gateway: each of these means no finding. ZopNight never emits a zero-dollar recommendation for this rule.

Access involved

Reader covers gateway discovery and configuration reads; Monitoring Reader covers both metric series. Removal itself stays manual. A gateway delete rewires ingress, and no automation should make that call from traffic data alone.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·