An unattached NAT Gateway routes nothing but still bills ~$32/mo base

Why it happens

A NAT Gateway bills a flat hourly base rate the moment it is deployed, plus per-gigabyte data processing when it is actually in use. There is no paused or stopped state, so the base rate runs continuously whether or not a single subnet points at it.

The association is a separate lifecycle from the gateway itself. Subnets get reconfigured, a VNet is redesigned, or workloads move to a different egress path, and the gateway is left with its subnets property empty or absent. It provides zero utility in that state, but nothing flags it as broken, so it lingers.

What it costs / blast radius

The base rate alone is roughly $32/month at list price, about $385/year, for a gateway that connects nothing. (List price; data-processing charges are separate and your contract may differ.) That is a modest number on its own, but an unattached NAT Gateway delivers literally zero value for it, and these accumulate one abandoned VNet redesign at a time.

See it

Resources
| where type =~ 'microsoft.network/natgateways'
| extend subnetCount = array_length(properties.subnets)
| where isnull(subnetCount) or subnetCount == 0
| project name, resourceGroup, subscriptionId, location,
          sku = tostring(sku.name)

// If a subnet still needs outbound NAT, associate it:
az network vnet subnet update \
  --name workloads --vnet-name vnet-prod --resource-group rg-network \
  --nat-gateway natgw-prod

// Otherwise remove the orphan so the base rate stops:
az network nat gateway delete \
  --name natgw-prod --resource-group rg-network