Explanation
Why the waste happens and who it affects.
In these cases, the WAF is no longer serving any functional purpose but continues to incur fixed hourly costs. Because no traffic is routed and no applications are protected, the WAF is effectively inactive. These orphaned WAFs are easy to overlook without regular cleanup processes and can quietly accumulate unnecessary charges over time.
The same waste applies to Standard_v2 Application Gateways without WAF. Both v2 SKUs charge a fixed hourly amount for as long as the gateway is provisioned, and Microsoft's pricing guide states that this fixed cost applies even when the autoscale minimum instance count is 0. A gateway with empty backend pools therefore keeps billing the fixed charge, plus 10 capacity units per instance for any manual or minimum instance count, while serving no application.
Billing model
The pricing dimensions that drive this cost.
Azure WAF on Application Gateway is billed based on:
- Fixed hourly gateway charge
- Incurred as long as the WAF_v2 gateway is provisioned, regardless of traffic volume or instance count
- Capacity unit charges
- Based on compute, persistent connections, and throughput consumed, with capacity units reserved by the minimum instance count billed even when no traffic flows; WAF_v2 has no per-GB data processing charge
- Fixed hourly charge
- Billed per hour while a Standard_v2 or WAF_v2 gateway is provisioned, even with a minimum instance count of 0; a partial hour bills as a full hour
- Public IP address
- The gateway's public IP is billed separately from the gateway's fixed cost
A WAF remains billable as long as it is provisioned, even if there are no active backend pool resources or traffic flowing through it.
How to detect
6 checks to find it in your estate.
- Identify WAF-enabled Application Gateways with no associated backend pool targets
- Review traffic metrics or diagnostic logs to confirm that no requests are being processed
- Validate that the WAF is not in use by other services such as Front Door or CDN endpoints
- Consult with application teams to determine whether the WAF is still needed for future use
- Run the FinOps toolkit Azure Resource Graph query 'Identify idle application gateways', which expands properties.backendAddressPools and returns gateways where both backendIPConfigurations and backendAddresses are empty; FinOps hubs can raise this as a recommendation automatically
- For non-production gateways, check whether request and throughput metrics drop to near zero outside business hours
How to fix
5 ways to remove the waste.
- Delete idle WAF_v2 Application Gateways that are no longer routing traffic or protecting active applications; WAF policies and rules carry no separate charge on Application Gateway, so deleting only the WAF policy does not reduce cost. If the gateway itself must remain, evaluate whether it can run on the Standard_v2 tier without WAF
- Establish periodic audits to flag and review WAFs with empty backend pools
- Use automated checks to detect and alert on WAF deployments with no active use
- For non-production gateways that are needed only during working hours, stop them with Stop-AzApplicationGateway and start them with Start-AzApplicationGateway; the Well-Architected guide for Application Gateway states that a stopped gateway doesn't incur costs
- When deleting an idle gateway, also delete its public IP address if nothing else uses it, since the IP is billed separately
Documentation
Vendor references for pricing and configuration.