Managed disks in the Unattached state for at least 7 days
What does ZopNight detect here?
Azure managed disks keep billing at their full provisioned tier after they are detached or their VM is deleted. ZopNight flags disks whose `diskState` is exactly `Unattached`, skips Site Recovery and Kubernetes volumes, waits 7 days after detachment when that time is known, and reports the disk's full monthly cost as the saving.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-212 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Threshold | Unattached for at least 7 days |
| Evaluation window | 7d |
| Source | ZopNight |
| Permissions used | Microsoft.Compute/disks/read |
Where it applies
Detached disks bill as if they were in use
Microsoft’s unattached disk guide is blunt: deleting a VM does not delete its disks by default, and after the VM is gone you continue to pay for them. Managed disk pricing bills each disk hourly at the tier that fits its size, at the same rate regardless of how much of the disk is used. A 1 TiB Premium SSD left over from a deleted database server costs the same every hour as the day it was in service.
Finding unattached disks
A disk attached to a VM has its managedBy property set to the VM’s ID; an unattached disk has it
set to null. LastOwnershipUpdateTime records when the disk’s state last changed, which for an
unattached disk is the moment it was detached:
az disk list \ --query '[?managedBy==`null`].{name:name, group:resourceGroup, sizeGB:diskSizeGB, sku:sku.name, state:diskState}' -o table
az disk show --resource-group <rg> --name <disk> --query "{state:diskState, since:lastOwnershipUpdateTime}"Conditions for an unattached-disk finding
- The disk’s
diskStateis exactlyUnattached. Other states, includingReservedandActiveSAS, are never flagged. - When the detachment time is known, it is at least 7 days in the past. A disk detached moments ago is usually mid-rebuild or mid-migration.
- The disk has a price for its size and tier.
Disks ZopNight deliberately ignores
Azure Site Recovery keeps unattached disks on purpose. Names containing ASRReplica (Azure-to-Azure
replication) or starting with asrseeddisk (VMware and physical server replication seeds) are
skipped. So are disks provisioned by Kubernetes, recognised by pvc- or kubernetes-dynamic-pvc-
name prefixes or Kubernetes tags, because deleting one would strand the pod that owns the volume.
When the detachment time is missing, the state check alone decides.
A newly created empty Premium SSD, Standard SSD or Standard HDD disk is not billed until it is first attached, per the pricing FAQ, so a disk that has never been attached may have no price and no finding. Snapshots of deleted disks are covered by Orphaned Azure Snapshot.
The saving is the full disk charge
saving = provisioned size x disk tier rate, per monthcost after fix = 0Deleting a disk you no longer need
- Confirm no VM, scale set or cluster expects to reattach the disk.
- Take a snapshot if the data may be needed; an incremental snapshot is billed only for used size.
- Delete the disk:
az disk delete --resource-group <rg> --name <disk>. - Remove any snapshots of it that are no longer needed.