https://getstratolens.com/footguns The ways Azure quietly costs you money or exposes you to risk, documented one by one. New footguns as they are published. en-us Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/nsg-admin-ports-open-to-internet https://getstratolens.com/footguns/nsg-admin-ports-open-to-internet An NSG inbound Allow rule from 0.0.0.0/0 on RDP, SSH, or a database port is the most exploited misconfiguration class in Azure. Automated scanners find it in minutes, not weeks. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/pim-eligible-assignment-unused https://getstratolens.com/footguns/pim-eligible-assignment-unused An eligible assignment on a privileged role that hasn't been activated in months isn't hygiene, it's a live escalation path the principal (or whoever compromises it) can exercise any time. governance Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/service-principal-privileged-subscription-role https://getstratolens.com/footguns/service-principal-privileged-subscription-role An automation identity holding Owner or Contributor across the whole subscription is a standing, non-interactive credential with a subscription-sized blast radius, and PIM can't help it. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/nsg-sensitive-ports-public-ip-allowlist https://getstratolens.com/footguns/nsg-sensitive-ports-public-ip-allowlist Allow-listing the office IP for SSH or RDP feels like the responsible version of an open port. It's better than 0.0.0.0/0, and it still puts an identity-less protocol on the internet behind addresses that rot. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/vnet-peering-disconnected https://getstratolens.com/footguns/vnet-peering-disconnected VNet peering is two resources, one on each network, and both must exist for traffic to flow. Create only one side, or delete one side later, and the survivor sits there carrying nothing. reliability Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/subnet-without-nsg https://getstratolens.com/footguns/subnet-without-nsg Azure does not require an NSG on a subnet. Without one there is no subnet-level network filter at all, and every workload inside relies entirely on whatever other controls happen to exist. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/waf-policy-detection-mode-only https://getstratolens.com/footguns/waf-policy-detection-mode-only Azure WAF policies start life in Detection mode, which monitors and logs matching requests but blocks nothing. The flip to Prevention is a manual step that routinely never happens. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/application-gateway-not-waf-sku https://getstratolens.com/footguns/application-gateway-not-waf-sku An Application Gateway on the Standard SKU terminates TLS and routes requests but inspects nothing. SQL injection and XSS pass through it exactly like a login page does. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/app-service-no-managed-identity https://getstratolens.com/footguns/app-service-no-managed-identity An App Service without a managed identity authenticates to databases, storage, and Key Vault with connection strings and keys in app settings — a whole credential class Azure would let you delete. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/signalr-public-network-access-enabled https://getstratolens.com/footguns/signalr-public-network-access-enabled The realtime channel pushing live data to your users' browsers accepts connections from any internet address. Access keys and tokens are the whole boundary, and the default is Enabled. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/ai-search-public-network-access-enabled https://getstratolens.com/footguns/ai-search-public-network-access-enabled The search index is usually the retrieval layer of a RAG pipeline, holding full copies of the documents it ingested. A public endpoint makes one leaked key equal to the whole corpus. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/cognitive-services-public-network-access-enabled https://getstratolens.com/footguns/cognitive-services-public-network-access-enabled Your Azure OpenAI or AI services account is reachable from the internet, so an API key is the only thing standing between the world and your models, your quota, and any data your prompts carry. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/service-bus-local-auth-enabled https://getstratolens.com/footguns/service-bus-local-auth-enabled Every Service Bus namespace ships with SAS-key authentication enabled, and the root key grants manage rights over the whole namespace. Those keys live in connection strings, and a connection string is not an identity. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/service-bus-public-network-access-enabled https://getstratolens.com/footguns/service-bus-public-network-access-enabled Service Bus namespaces allow public network traffic by default. The broker gluing your systems together, and every in-flight order, job, and event sitting in its queues, is reachable from anywhere. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/event-hubs-local-auth-enabled https://getstratolens.com/footguns/event-hubs-local-auth-enabled Every Event Hubs namespace ships with SAS-key authentication enabled. The keys are long-lived static secrets that bypass Entra ID and conditional access, and they live in connection strings scattered through configs. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/event-hubs-public-network-access-enabled https://getstratolens.com/footguns/event-hubs-public-network-access-enabled Event Hubs namespaces allow traffic over the public network by default. The stream carrying your telemetry and business events is reachable from anywhere, and authentication is the only gate. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/linux-vm-ssh-password-auth-enabled https://getstratolens.com/footguns/linux-vm-ssh-password-auth-enabled The Linux VM was deployed with disablePasswordAuthentication set to false, so sshd accepts passwords: guessable, reusable, phishable credentials with no MFA in front of them. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/vm-unmanaged-os-disk https://getstratolens.com/footguns/vm-unmanaged-os-disk Unmanaged VHD disks were fully retired on March 31, 2026. A VM still booting from one is running on borrowed time, outside modern snapshot, encryption, and reliability tooling. governance Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/vm-boot-diagnostics-disabled https://getstratolens.com/footguns/vm-boot-diagnostics-disabled Boot diagnostics is off unless someone turned it on, and you discover that at the worst possible moment: mid-outage, staring at a VM that won't boot and produces no evidence about why. reliability Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/vm-trusted-launch-disabled https://getstratolens.com/footguns/vm-trusted-launch-disabled Trusted Launch brings Secure Boot and vTPM to Azure VMs at no extra cost, but plenty of deployment paths still create Standard VMs where the entire boot chain runs unverified. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/managed-disk-public-export-enabled https://getstratolens.com/footguns/managed-disk-public-export-enabled Managed disks default to AllowAll network access with public export enabled. One export SAS turns the entire disk into a downloadable file, no VM login required. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/aks-no-network-policy https://getstratolens.com/footguns/aks-no-network-policy Unless you choose a network policy engine at cluster creation, AKS enforces none. Kubernetes NetworkPolicy resources are silently ignored and the pod network is completely flat. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/aks-kubernetes-rbac-disabled https://getstratolens.com/footguns/aks-kubernetes-rbac-disabled With enableRBAC: false there is no in-cluster authorization at all: every kubeconfig, service account token, and pipeline credential is effectively cluster-admin. And RBAC cannot be enabled on an existing cluster. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/aks-local-accounts-enabled https://getstratolens.com/footguns/aks-local-accounts-enabled Local accounts are enabled on AKS by default. Anyone with the right Azure role can pull an admin kubeconfig that works with no identity attached, ignores conditional access, and keeps working after they leave. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/aks-public-api-server https://getstratolens.com/footguns/aks-public-api-server The default AKS deployment gives the Kubernetes API server a public endpoint with no IP restrictions. The API that can read every secret and exec into every pod is reachable from anywhere. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/mysql-flexible-server-public-access https://getstratolens.com/footguns/mysql-flexible-server-public-access The MySQL flexible server sits on a public endpoint guarded only by IP firewall rules, and the creation-time connectivity choice can't simply be swapped out later. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/postgresql-flexible-server-public-access https://getstratolens.com/footguns/postgresql-flexible-server-public-access The Postgres server answers on a publicly resolvable endpoint. Firewall rules, plain IP allow-lists with no identity behind them, are the only thing between your data and the internet. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/redis-non-ssl-port-enabled https://getstratolens.com/footguns/redis-non-ssl-port-enabled Plaintext port 6379 is open alongside the TLS port. Every GET and SET, session tokens included, crosses the network unencrypted, and so does the access key during AUTH. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/redis-public-network-access-enabled https://getstratolens.com/footguns/redis-public-network-access-enabled A cache that usually holds session tokens and hot application data is reachable from the internet, and an access key is the only thing standing in the way. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/container-registry-anonymous-pull-enabled https://getstratolens.com/footguns/container-registry-anonymous-pull-enabled With anonymous pull enabled, unauthenticated clients can download images from the registry. Images carry baked-in config, internal hostnames, and more often than anyone admits, credentials. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/container-registry-admin-user-enabled https://getstratolens.com/footguns/container-registry-admin-user-enabled The ACR admin account is a single shared username/password with full push and pull rights and no identity behind it. It ends up pasted into CI configs everywhere, and a leak means someone else decides what your clusters run. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/container-registry-public-network-access-enabled https://getstratolens.com/footguns/container-registry-public-network-access-enabled The registry that feeds your production clusters accepts connections from any internet address. Authentication becomes the only barrier between the world and the images everything runs on. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/cosmos-db-no-automatic-failover https://getstratolens.com/footguns/cosmos-db-no-automatic-failover You pay for a second Cosmos DB region so an outage can't take you down. With automatic failover disabled, it still can — promotion of the read region waits for someone to click the button. reliability Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/cosmos-db-local-auth-enabled https://getstratolens.com/footguns/cosmos-db-local-auth-enabled Every Cosmos DB account ships with two master keys enabled. A key in a connection string is full access to all the data — no Entra ID, no RBAC, no conditional access, no per-user audit trail. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/key-vault-legacy-access-policies https://getstratolens.com/footguns/key-vault-legacy-access-policies Vaults created without enableRbacAuthorization manage permissions through a per-vault access-policy list that RBAC tooling, access reviews, and PIM never touch. governance Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-account-legacy-v1 https://getstratolens.com/footguns/storage-account-legacy-v1 General-purpose v1 accounts predate blob access tiers, lifecycle management, and a decade of security and pricing evolution. Microsoft has scheduled their retirement for 2026 — accounts left behind get migrated on Microsoft's timetable, not yours. governance Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-cross-tenant-replication-enabled https://getstratolens.com/footguns/storage-cross-tenant-replication-enabled With allowCrossTenantReplication enabled, an object replication policy can name a destination account in a completely different Entra tenant — a data-movement channel that looks like a legitimate Azure feature because it is one. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-shared-key-auth-enabled https://getstratolens.com/footguns/storage-shared-key-auth-enabled Every storage account is born with two account keys and shared key authorization enabled. Anyone holding a key gets full data-plane access — no Entra ID, no RBAC, no Conditional Access, no name in the logs. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-account-firewall-default-allow https://getstratolens.com/footguns/storage-account-firewall-default-allow A storage account whose networkAcls.defaultAction is Allow accepts traffic from every network. The firewall exists, the rule list looks reassuring, and none of it filters anything. security Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/subscription-vcpu-quota-nearing-limit https://getstratolens.com/footguns/subscription-vcpu-quota-nearing-limit vCPU quotas are per subscription, per region, per VM family — and nothing warns you as they fill. The first symptom is a QuotaExceeded error on the day a deployment, scale-out, or failover actually mattered. reliability Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/reservation-expiring-unplanned https://getstratolens.com/footguns/reservation-expiring-unplanned A reservation quietly reaches the end of its term and every covered resource reverts to pay-as-you-go rates overnight. The bill jump lands before anyone connects it to the lapse. cost Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/reserved-instance-underutilized https://getstratolens.com/footguns/reserved-instance-underutilized You pre-paid for capacity you aren't using. A reservation running below its utilization threshold burns committed dollars silently every hour, and Azure never rolls the unused hours forward. cost Thu, 09 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/rbac-redundant-assignment https://getstratolens.com/footguns/rbac-redundant-assignment Assigning Reader on a resource group to someone who already has Owner on the subscription grants nothing new. It just clutters every access review. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/rbac-excessive-sprawl https://getstratolens.com/footguns/rbac-excessive-sprawl When one principal holds the same role in subscription after subscription, it is usually a blanket grant, not a deliberate per-subscription decision. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/rbac-stale-assignment https://getstratolens.com/footguns/rbac-stale-assignment Privileged access granted for a project or an incident routinely outlives the need. The role keeps full standing access long after anyone last exercised it. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/rbac-unused-assignment https://getstratolens.com/footguns/rbac-unused-assignment A principal holds a privileged role but has performed no operations in its scope. It is standing access with nothing on the other side of the ledger. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/rbac-over-scoped-assignment https://getstratolens.com/footguns/rbac-over-scoped-assignment A Contributor or Owner assignment sits at subscription scope, but every operation the principal performs lands in one resource group. The rest of the subscription is exposed for nothing. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/rbac-over-privileged-assignment https://getstratolens.com/footguns/rbac-over-privileged-assignment A principal holds Owner but its actual activity is read/deploy work that Contributor or Reader would cover. The extra privilege is pure blast radius with no offsetting use. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/api-connection-orphaned https://getstratolens.com/footguns/api-connection-orphaned An API Connection referenced by no Logic App still holds the OAuth token or API key it was authorized with, quietly outliving the workflow it was created for. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/firewall-policy-orphaned https://getstratolens.com/footguns/firewall-policy-orphaned A Firewall Policy attached to no Azure Firewall and inherited by no child policy is a complete ruleset that enforces nothing, yet still reads as authoritative. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/ip-group-orphaned https://getstratolens.com/footguns/ip-group-orphaned An IP Group referenced by no firewall or firewall policy serves no purpose, but it still looks like a live allowlist that engineers assume is enforced. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/resource-group-empty https://getstratolens.com/footguns/resource-group-empty A resource group that contains nothing still carries tags, RBAC assignments, policy scope, and a place in every report, adding noise no one ever cleans up. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/subnet-empty https://getstratolens.com/footguns/subnet-empty A subnet with no NICs, private endpoints, or delegations carves out address space that nothing uses, quietly shrinking the range available for real workloads. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/virtual-network-empty https://getstratolens.com/footguns/virtual-network-empty A virtual network with no subnets provides no networking capability at all, yet it reserves an address space and adds one more thing to reason about in every peering and IP-planning decision. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/route-table-unattached https://getstratolens.com/footguns/route-table-unattached A route table associated with no subnet steers no traffic, but its user-defined routes still sit in inventory, inviting confusion about how packets actually flow. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/network-security-group-orphaned https://getstratolens.com/footguns/network-security-group-orphaned A network security group associated with no subnet and no NIC enforces nothing, but its rules still show up in every review, quietly implying protection that isn't there. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/network-interface-unattached https://getstratolens.com/footguns/network-interface-unattached A network interface with no VM, no private endpoint, and no owning resource bills nothing, so it lingers, carrying its old NSG and IP configuration into your security posture as dead weight. governance Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/private-endpoint-disconnected https://getstratolens.com/footguns/private-endpoint-disconnected A Private Endpoint whose connection is Disconnected, or whose provisioning failed, no longer routes to its Private Link service. Anything relying on that private path fails, and the endpoint keeps billing. reliability Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/load-balancer-empty-backend-pool https://getstratolens.com/footguns/load-balancer-empty-backend-pool A Load Balancer whose backend pool has no members has nothing to forward to. Connections to its frontend IP are dropped, and the failure is easy to blame on the network. reliability Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/application-gateway-no-backends https://getstratolens.com/footguns/application-gateway-no-backends An Application Gateway whose backend pools have no targets answers every request with a 502. It keeps billing until someone stops or deletes it, so it charges the whole time it serves errors. reliability Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/privileged-access-standing-too-long https://getstratolens.com/footguns/privileged-access-standing-too-long Owner and User Access Administrator granted as permanent, always-on assignments sit for months. Every day they stand is a day they can be abused. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/resource-public-ip-internet-facing https://getstratolens.com/footguns/resource-public-ip-internet-facing Attaching a public IP to a NIC or load balancer moves a resource from private to internet-facing in one property change, with no separate confirmation. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-infrastructure-encryption-disabled https://getstratolens.com/footguns/storage-infrastructure-encryption-disabled Infrastructure (double) encryption adds a second at-rest layer under the standard one. It can only be set at account creation, so once it's off, it stays off. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/https-only-disabled https://getstratolens.com/footguns/https-only-disabled Secure transfer on Storage, or HTTPS-only on App Service, gets switched off and the endpoint starts accepting plaintext HTTP requests. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/minimum-tls-version-lowered https://getstratolens.com/footguns/minimum-tls-version-lowered A minimum-TLS setting drops from TLS 1.2 to TLS 1.0 on a storage account, SQL server, or web app, and weak, deprecated transport encryption is allowed again. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/app-service-public-network-access-enabled https://getstratolens.com/footguns/app-service-public-network-access-enabled An App Service locked to a private endpoint gets publicNetworkAccess set back to Enabled and the site is answering the public internet again. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/key-vault-soft-delete-disabled https://getstratolens.com/footguns/key-vault-soft-delete-disabled A Key Vault with enableSoftDelete set to false has no recovery net. Delete a secret or the vault and it is gone immediately, with no restore. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/key-vault-firewall-default-allow https://getstratolens.com/footguns/key-vault-firewall-default-allow A Key Vault whose networkAcls.defaultAction is set to Allow accepts traffic from everywhere. Your carefully built allow-list still exists but no longer gates anything. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/key-vault-public-network-access-enabled https://getstratolens.com/footguns/key-vault-public-network-access-enabled A Key Vault with publicNetworkAccess set to Enabled answers requests from the internet. A private endpoint does not disable it. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/cosmos-db-public-network-access-enabled https://getstratolens.com/footguns/cosmos-db-public-network-access-enabled A Cosmos DB account with publicNetworkAccess set to Enabled accepts connections from the public internet. A private endpoint does not turn this off. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/sql-server-public-network-access-enabled https://getstratolens.com/footguns/sql-server-public-network-access-enabled Enabling public network access on an Azure SQL logical server makes its endpoint resolvable and reachable from the internet, leaving login credentials and firewall rules as the only defense. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-blob-anonymous-access-enabled https://getstratolens.com/footguns/storage-blob-anonymous-access-enabled Setting allowBlobPublicAccess to true lets any container or blob be configured for anonymous reads, so data can be pulled over plain HTTPS with no credentials at all. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-account-public-network-access-enabled https://getstratolens.com/footguns/storage-account-public-network-access-enabled Flipping a storage account's public network access from Disabled to Enabled exposes its blob, file, queue, and table endpoints to the whole internet, gated only by keys and identity. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/cost-pattern-shift-anomaly https://getstratolens.com/footguns/cost-pattern-shift-anomaly A resource's spend steps up to a permanently higher level and stays there. Unlike a spike it never comes back down, so it's easy to accept as the new normal. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/cost-spike-anomaly https://getstratolens.com/footguns/cost-spike-anomaly One resource's daily cost jumps sharply above its normal level. Subscription-total budget alerts don't see it, so the spike inflates the bill until month-end. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/vm-oversized-for-workload https://getstratolens.com/footguns/vm-oversized-for-workload A VM sits at a fraction of its provisioned CPU and memory, so you pay for a SKU far larger than the workload uses. Nothing is broken, so nothing prompts a resize. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/container-registry-idle https://getstratolens.com/footguns/container-registry-idle Azure Container Registry bills a fixed daily rate for its tier regardless of use. A registry with zero pulls and pushes keeps charging as if it were in active service. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/frontdoor-waf-policy-orphaned https://getstratolens.com/footguns/frontdoor-waf-policy-orphaned A Front Door WAF policy only inspects traffic it is linked to. With no security-policy or endpoint links it protects nothing, but it keeps billing its per-policy rate. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/private-dns-zone-orphaned https://getstratolens.com/footguns/private-dns-zone-orphaned A Private DNS zone needs a virtual network link to answer queries. With zero links it resolves nothing, yet it keeps billing its per-zone base charge. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/traffic-manager-profile-idle https://getstratolens.com/footguns/traffic-manager-profile-idle A profile that still has endpoints but receives zero DNS queries keeps billing per-endpoint health monitoring for a name no client is using anymore. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/traffic-manager-profile-empty https://getstratolens.com/footguns/traffic-manager-profile-empty A Traffic Manager profile with no endpoints can resolve nothing, yet it holds a trafficmanager.net name and sits in inventory as finished-looking dead config. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/expressroute-circuit-unprovisioned https://getstratolens.com/footguns/expressroute-circuit-unprovisioned An ExpressRoute circuit that never completed provisioning with a provider bills its full monthly rate anyway, and the gateway you stood up for it bills on top. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/nat-gateway-idle-zero-traffic https://getstratolens.com/footguns/nat-gateway-idle-zero-traffic A NAT Gateway still wired to a subnet but moving zero bytes and packets keeps billing its hourly base rate. Azure has no way to pause it. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/sql-elastic-pool-empty https://getstratolens.com/footguns/sql-elastic-pool-empty A SQL Elastic Pool with no databases keeps billing its provisioned eDTU/vCore capacity. The pool charges for the compute it reserves, whether or not a single database sits in it. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/storage-account-idle-zero-transactions https://getstratolens.com/footguns/storage-account-idle-zero-transactions A storage account with zero transactions still bills for the data sitting in it. The charge is the stored bytes, not the activity, so an untouched account keeps costing money. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/empty-app-service-plan https://getstratolens.com/footguns/empty-app-service-plan An App Service Plan bills for its reserved compute tier, not for the apps on it. Delete every app and the plan keeps charging the full rate for hosting nothing. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/stale-disk-snapshot https://getstratolens.com/footguns/stale-disk-snapshot A disk snapshot is a point-in-time copy that never expires on its own. Kept past its useful life, it accrues per-GB storage charges every month until someone deletes it. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/stopped-vm-not-deallocated https://getstratolens.com/footguns/stopped-vm-not-deallocated Shutting a VM down from inside the guest OS leaves it Stopped, not Deallocated. Azure keeps charging full compute, disks, and reserved IPs as if it were running. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/application-gateway-idle-zero-traffic https://getstratolens.com/footguns/application-gateway-idle-zero-traffic A fully configured Application Gateway left running bills a flat hourly rate even when it serves zero requests. The only ways to end the charge are to stop it or delete it. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/nat-gateway-unattached https://getstratolens.com/footguns/nat-gateway-unattached A NAT Gateway with no subnet associations provides zero outbound connectivity, but its hourly base rate runs 24/7 with no way to pause it. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/vpn-gateway-idle-zero-connections https://getstratolens.com/footguns/vpn-gateway-idle-zero-connections A VPN Gateway bills a fixed hourly rate whether or not a single tunnel is up. There is no stopped state, so an idle gateway is pure waste. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/nsg-inbound-any-source https://getstratolens.com/footguns/nsg-inbound-any-source A single inbound allow rule with source Any (0.0.0.0/0) turns whatever sits behind it into a target for the internet's background scanning traffic. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/idle-azure-bastion https://getstratolens.com/footguns/idle-azure-bastion Bastion is billed per deployment-hour, not per session. A host left running in a low-traffic or abandoned VNet charges around the clock for sessions nobody opens. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/unattached-standard-public-ip https://getstratolens.com/footguns/unattached-standard-public-ip Standard SKU public IPs are always statically allocated and always billed. When the load balancer or NIC they fronted goes away, the IP keeps charging. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/unattached-managed-disk https://getstratolens.com/footguns/unattached-managed-disk Delete a VM and its data disks usually survive. A managed disk in the Unattached state bills its full provisioned capacity whether or not anything reads it. cost Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/keyvault-purge-protection-disabled https://getstratolens.com/footguns/keyvault-purge-protection-disabled Without purge protection, a deleted Key Vault can be permanently purged before the retention window ends, taking the data its keys encrypted with it. security Wed, 01 Jul 2026 00:00:00 GMT https://getstratolens.com/footguns/ddos-protection-plan-unassociated https://getstratolens.com/footguns/ddos-protection-plan-unassociated Network DDoS Protection Plans charge a flat monthly fee even with zero VNets attached. A detached plan is pure waste. cost Wed, 01 Jul 2026 00:00:00 GMT