Managed disk snapshots whose source disk no longer exists

Snapshots outlive their disks

Microsoft’s snapshot guide describes a managed disk snapshot as a full, read-only, point-in-time copy that exists independently of the source disk. Deleting the disk does not delete its snapshots. The same page says snapshots are billed on used size: a 64 GiB disk with 10 GiB of data produces a snapshot billed for 10 GiB. Incremental snapshots are also billed for used size only, and always use Standard HDD storage whatever the source disk type.

Once the source disk is gone, nobody is snapshotting that disk any more, and the remaining copies usually belong to a server that was retired long ago.

Finding snapshots with a missing source

List the snapshots with the disk each one came from, then check whether that disk still exists:

az snapshot list \
  --query "[].{name:name, group:resourceGroup, source:creationData.sourceResourceId, sizeGB:diskSizeGB}" -o table

az disk show --ids <source-disk-id> --query name -o tsv

If the second command reports that the resource was not found, the source disk has been deleted.

How the finding is assembled

ZopNight does not raise one finding per snapshot. Snapshots whose source disk has been deleted are rolled up into a single entry for each subscription and region, carrying the number of orphaned snapshots and their combined size. The rule fires when that entry is active, holds at least one snapshot, and has a positive price. Snapshots whose source disk still exists are not part of it.

Limits on the estimate

The price is built from provisioned size, the sum of each snapshot’s disk size in GB, at the standard snapshot rate. Azure bills on used size, so for sparse disks the estimate is an upper bound on the real bill rather than an exact figure. If no price can be computed, there is no finding; a zero-cost entry is never shown. Unattached disks, as opposed to snapshots, are handled by Unattached Azure Managed Disk.

Pricing the rollup

saving = total provisioned GB of orphaned snapshots x standard snapshot rate per GB-month
cost after fix = 0

Clearing orphaned snapshots

1. Confirm the source disks were deleted on purpose and the data is no longer needed.
2. If some data may be required, create a managed disk from the snapshot first, or keep only the newest snapshot of each series.
3. Check that no image or restore process depends on the snapshots.
4. Delete them in the portal (Snapshots, filter by region) or with az snapshot delete --resource-group <rg> --name <snapshot>.