# Inactive web application firewall (WAF) | Cloud Efficiency Hub Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/inactive-web-application-firewall-waf Azure WAF configurations attached to Application Gateways can persist after their backend pool resources have been removed - often during environment... By: Balazs Engedi Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Inactive Web Application Firewall (WAF) The short version Azure WAF configurations attached to Application Gateways can persist after their backend pool resources have been removed - often during environment reconfiguration or application decommissioning. [Balazs Engedi](https://www.linkedin.com/in/engedib/) FinOps Specialist @ KPN Azure service [Azure WAF](https://www.pointfive.co/efficiency-hub/cloud-services/azure-waf) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0007 Type Idle or Unused Resource ## Explanation Why the waste happens and who it affects. In these cases, the WAF is no longer serving any functional purpose but continues to incur fixed hourly costs. Because no traffic is routed and no applications are protected, the WAF is effectively inactive. These orphaned WAFs are easy to overlook without regular cleanup processes and can quietly accumulate unnecessary charges over time. The same waste applies to Standard\_v2 Application Gateways without WAF. Both v2 SKUs charge a fixed hourly amount for as long as the gateway is provisioned, and Microsoft's pricing guide states that this fixed cost applies even when the autoscale minimum instance count is 0. A gateway with empty backend pools therefore keeps billing the fixed charge, plus 10 capacity units per instance for any manual or minimum instance count, while serving no application. ## Billing model The pricing dimensions that drive this cost. Azure WAF on Application Gateway is billed based on: Fixed hourly gateway charge Incurred as long as the WAF\_v2 gateway is provisioned, regardless of traffic volume or instance count Capacity unit charges Based on compute, persistent connections, and throughput consumed, with capacity units reserved by the minimum instance count billed even when no traffic flows; WAF\_v2 has no per-GB data processing charge Fixed hourly charge Billed per hour while a Standard\_v2 or WAF\_v2 gateway is provisioned, even with a minimum instance count of 0; a partial hour bills as a full hour Public IP address The gateway's public IP is billed separately from the gateway's fixed cost A WAF remains billable as long as it is provisioned, even if there are no active backend pool resources or traffic flowing through it. ## How to detect 6 checks to find it in your estate. - Identify WAF-enabled Application Gateways with no associated backend pool targets - Review traffic metrics or diagnostic logs to confirm that no requests are being processed - Validate that the WAF is not in use by other services such as Front Door or CDN endpoints - Consult with application teams to determine whether the WAF is still needed for future use - Run the FinOps toolkit Azure Resource Graph query 'Identify idle application gateways', which expands properties.backendAddressPools and returns gateways where both backendIPConfigurations and backendAddresses are empty; FinOps hubs can raise this as a recommendation automatically - For non-production gateways, check whether request and throughput metrics drop to near zero outside business hours ## How to fix 5 ways to remove the waste. - Delete idle WAF\_v2 Application Gateways that are no longer routing traffic or protecting active applications; WAF policies and rules carry no separate charge on Application Gateway, so deleting only the WAF policy does not reduce cost. If the gateway itself must remain, evaluate whether it can run on the Standard\_v2 tier without WAF - Establish periodic audits to flag and review WAFs with empty backend pools - Use automated checks to detect and alert on WAF deployments with no active use - For non-production gateways that are needed only during working hours, stop them with Stop-AzApplicationGateway and start them with Start-AzApplicationGateway; the Well-Architected guide for Application Gateway states that a stopped gateway doesn't incur costs - When deleting an idle gateway, also delete its public IP address if nothing else uses it, since the IP is billed separately ## Documentation Vendor references for pricing and configuration. - [Azure WAF Pricing azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/web-application-firewall/) - [Application Gateway WAF Overview learn.microsoft.com](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview) - [Understanding pricing - Azure Application Gateway learn.microsoft.com](https://learn.microsoft.com/en-us/azure/application-gateway/understanding-pricing) - [FinOps best practices for Networking learn.microsoft.com](https://learn.microsoft.com/en-us/cloud-computing/finops/best-practices/networking) - [Architecture Best Practices for Azure Application Gateway v2 learn.microsoft.com](https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-application-gateway) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure NAT Gateway CER-0319 ### [Idle Azure NAT Gateway Attached to Subnet Without Active Workloads](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-azure-nat-gateway-attached-to-subnet-without-active-workloads) Azure NAT Gateways are commonly deployed to provide outbound internet connectivity for resources within virtual network subnets. Over time, the workloads that originally required this outbound access may be scaled down, migrated, or... Networking - Azure Private Link CER-0318 ### [Orphaned Private Endpoints After Target Service Deletion](https://www.pointfive.co/efficiency-hub/inefficiencies/orphaned-private-endpoints-after-target-service-deletion) Azure Private Endpoints are network interfaces that provide private connectivity from a virtual network to Azure PaaS services such as Storage Accounts, SQL Databases, or Key Vaults. When the target service behind a private endpoint is... Networking - Azure Bastion CER-0312 ### [Idle or Underutilized Azure Bastion Deployment](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-or-underutilized-azure-bastion-deployment) Azure Bastion incurs continuous hourly charges from the moment it is deployed until the resource is deleted - regardless of whether any connections are actively being made. This means a Bastion host sitting idle in a development or test... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.