Skip to main content
Back to blog

A Stopped Azure VM Is Not a Free One

Riya Mittal
Riya Mittal Engineer · Zop.Dev
3 min read
A Stopped Azure VM Is Not a Free One

Deallocating an Azure VM feels like turning off the meter. The compute charge does stop. What most teams miss is that the VM’s attached managed disks and its reserved public IP keep billing, at full price, for as long as the machine sits stopped. A VM someone switched off to save money in March can still be quietly charging for its disks in September.

The trap is the word “stopped.” Stopped-deallocated ends compute billing, so the VM drops out of the mental model of cost. But the disk is a separate resource with its own lifecycle. It does not stop when the VM does. Neither does the static public IP, which bills whenever it is reserved and not attached to a running resource.

ZopNight now flags Azure VMs that are switched off but still billing for their attached disks and public IP, and estimates the cleanup saving.

The cost that outlives the machine

A managed disk bills for its provisioned size, not its usage, and not the state of the VM in front of it. A stopped VM with a 1 TB premium SSD keeps paying for 1 TB. Multiply that by the fleet of VMs teams deallocate and forget: the test box from a launch, the migration source nobody deleted, the analytics node kept “just in case.” Each one is a disk and often an IP, billing every hour, attached to nothing that runs.

The reason this hides so well is that every dashboard agrees the VM is off. Compute cost reads zero, the instance shows stopped, and the eye moves on. The charge lives one layer down, on resources the stopped-VM view does not total up.

Architecture diagram

Flag it with the number attached

A finding is only useful if it comes with the size of the prize. ZopNight pairs each flagged VM with an estimated cleanup saving, so the decision is not “is this disk still needed” in the abstract, but “this stopped VM is costing this much a month for storage that runs nothing.”

VM stateComputeAttached diskReserved public IP
RunningBillingBillingBilling
Stopped (deallocated)Not billingStill billingStill billing
Deleted with disk and IPNoneNoneNone

The gap between row two and row three is the saving. It is money already committed to resources doing nothing, waiting for someone to notice.

When to act, and when to keep it

Act when the stopped VM is genuinely abandoned: a leftover from work that finished, with a disk nobody will restore. That is pure cleanup.

Keep it when the stop is intentional, a warm spare kept for fast restart or a machine paused between scheduled runs. There the disk cost is the price of a quick comeback, and that can be the right call. The flag does not force deletion. It surfaces the charge and the number, so a stopped VM stops being invisible and becomes a decision.

Tagged
Riya Mittal

Riya Mittal

Engineer · Zop.Dev

Riya works on the autonomous remediation engine at Zop.Dev. Before that she was a security engineer at a SaaS company that learned the hard way what 14 days of exposure looks like. She writes about cloud security, automation, and the trade-off between speed and safety.

Stop watching the waste.
Start cutting it.

See. Find. Fix. Automatic.

Connect your first cloud account in under 5 minutes. See your first remediation in under 7. No credit card required.

CDCR connect detect classify remediate
full audit every action traceable
read-only default access
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001 · zero-trust· 30% average cloud cost cut· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001 · zero-trust· 30% average cloud cost cut· 4 platforms · 1 console·