# Idle Azure Application Gateway

> Application Gateway bills per hour plus capacity units even at zero traffic, so ZopNight examines TotalRequests and CurrentConnections over 30 days and flags the gateway when every present series averages 0 with at least 7 days of history behind it. Empty backend pools are the usual root cause.

Source: https://zop.dev/integrations/azure/recommendations/idle-azure-application-gateway
Updated: 2026-08-19

---

## Layer-7 front doors that nobody walks through

An Application Gateway is typically the paid front door to something, until the something
moves behind Front Door, gets rebuilt on Container Apps, or is simply deleted while the
gateway stays. The hourly charge and provisioned capacity units keep billing either way.
ZopNight reads two Azure Monitor series on the gateway: `TotalRequests` (traffic served)
and `CurrentConnections` (clients attached). A positive average on either one proves the
gateway is still in the serving path, and the evaluation stops there.

## Both counters at zero, with history to back it

Whichever of the two series are present must average 0, and each present series needs at
least 7 days of trustworthy coverage. A gateway whose diagnostics were enabled on Tuesday
cannot be condemned by Friday. When neither series exists at all, the rule abstains: no
telemetry is a data gap, not evidence.

## Reproduce the traffic check

```bash
az monitor metrics list \
  --resource "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/applicationGateways/<name>" \
  --metric TotalRequests CurrentConnections \
  --interval PT1H --offset 30d --aggregation Average
```

While you are there, look at the backend pools; a gateway with zero traffic usually has
backends that were deallocated or deleted months ago:

```bash
az network application-gateway show -n <name> -g <rg> \
  --query "backendAddressPools[].backendAddresses" -o json
```

## What a delete takes with it

Removing the gateway ends the hourly and capacity-unit charges. Its public IP address is a
separate resource that survives and keeps billing, so plan to delete or reassign it in the
same change, along with WAF policies attached to nothing.

## Reasons the rule holds its fire

Any request or connection activity, both metric series missing, shallow coverage on a
present series, or an unpriced gateway: each of these means no finding. ZopNight never
emits a zero-dollar recommendation for this rule.

## Access involved

Reader covers gateway discovery and configuration reads; Monitoring Reader covers both
metric series. Removal itself stays manual. A gateway delete rewires ingress, and no
automation should make that call from traffic data alone.