Skip to main content
Back to the Azure Footguns Database
CostGovernanceHighRareAZF-0016

An ExpressRoute circuit that was never provisioned still bills — and its gateway bills separately

An ExpressRoute circuit that never completed provisioning with a provider bills its full monthly rate anyway, and the gateway you stood up for it bills on top.

Footgun ID
AZF-0016 (Azure Footgun No. 16)
Azure service
Azure ExpressRoute
Resource type
Microsoft.Network/expressRouteCircuits
Updated
July 1, 2026

What it is

An ExpressRoute circuit with no active peerings and a service-provider state of NotProvisioned: it was created in Azure but never actually connected through the carrier, or it was decommissioned on the provider side while the Azure resource lingered. It carries no traffic and never has, yet it bills the full monthly rate for its bandwidth tier.

Impact (cost)
$51 to $11,235/month at list price by bandwidth and peering, plus a separate gateway charge
Basis: Azure list price. Figures are estimates, not measurements.

Why it happens

Standing up ExpressRoute is a two-sided handshake. You create the circuit in Azure, hand the service key to your connectivity provider, and they provision their end. Billing on the Azure circuit begins when the resource exists, not when the provider finishes. So a circuit that stalls at NotProvisioned, because the project paused, the provider order fell through, or the link was later retired, sits on the bill in a state Azure does not consider an error.

Azure Advisor does not surface this case, which is part of why it hides so well. And the circuit is rarely the only charge: the ExpressRoute virtual network gateway you deployed to terminate it is a separate resource with its own hourly rate that keeps running independently.

What it costs / blast radius

Circuit list prices run from about $51/month for the smallest metered tier up to roughly $11,235/month for high-bandwidth unlimited plans, depending on bandwidth and peering location. (List price; your contract may differ.) On top of that, the ExpressRoute gateway bills its own hourly charge. Because these are among the most expensive networking resources in Azure, a single forgotten unprovisioned circuit and its gateway can be one of the largest pure-waste line items in a tenant.

See it

Find them: circuits that never connected to a provider
Resources
| where type =~ 'microsoft.network/expressRouteCircuits'
| where tostring(properties.serviceProviderProvisioningState) == 'NotProvisioned'
| where isnull(properties.peerings) or array_length(properties.peerings) == 0
| project name, resourceGroup, subscriptionId,
          sku = sku.name,
          bandwidthMbps = properties.serviceProviderProperties.bandwidthInMbps
Fix: delete BOTH the circuit and its gateway
// The circuit and the gateway bill separately. Remove both.
az network vnet-gateway delete --name <ergw> --resource-group rg
az network express-route delete --name <circuit> --resource-group rg

How StratoLens helps

StratoLens flags ExpressRoute circuits stuck at NotProvisioned with no peerings, automatically and continuously across every subscription, and shows the monthly cost still accruing. Given the price of these resources, catching one that never carried a packet, along with the gateway that shipped with it, is worth having a check that runs whether or not anyone remembers the circuit exists.

Start Your 28-Day Free Trial

Every feature unlocked. Deploys to your Azure tenant. No data leaves your tenant.

Available now on the Azure Marketplace.

Built for Azure infrastructure teams who need complete visibility across their entire estate.