How to Detect and Delete Unassociated Azure Public IP Addresses

Why Unused Public IPs Accumulate

When an Azure Virtual Machine, Bastion Host, or Application Gateway is decommissioned, its allocated Public IP resource is often preserved as an independent Azure Resource Manager (ARM) asset.

Because Microsoft charges for provisioned IPv4 reservations regardless of whether active traffic flows through them, forgotten public IPs quietly consume monthly cloud budget.

Azure Resource Graph Query for Orphan IPs

You can scan all subscriptions in your Azure tenant for unassociated Public IPs using this Kusto query in Azure Resource Graph Explorer:

Resources
| where type =~ 'microsoft.network/publicipaddresses'
| where properties.ipConfiguration == '' or isnull(properties.ipConfiguration)
| project name, resourceGroup, subscriptionId, location, properties.publicIPAllocationMethod, sku = properties.sku.name

Monthly Financial Impact of Reserved IPv4

While a single unused IP costs approximately $3.60 to $5.00/month, microservices and Kubernetes clusters with automated ingress controllers often leave dozens of orphan IPs behind, wasting hundreds of dollars every quarter across multiple subscription environments.

Releasing Unassociated IPs via Azure CLI

Once you have confirmed an IP is no longer required by any active DNS record or firewall allowlist, delete it using the Azure CLI:

# Delete an unassociated public IP
az network public-ip delete --resource-group rg-networking --name pip-decommissioned-vm

Continuous IP Hygiene with WasteRadar

WasteRadar automatically scans your entire Azure estate daily, flagging unassociated public IPs the moment workloads are destroyed and routing instant remediation alerts to your engineering team.