# Orphaned private endpoints after target service deletion Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/orphaned-private-endpoints-after-target-service-deletion Azure Private Endpoints are network interfaces that provide private connectivity from a virtual network to Azure PaaS services such as Storage... By: Shailaja Beeram Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Orphaned Private Endpoints After Target Service Deletion The short version Azure Private Endpoints are network interfaces that provide private connectivity from a virtual network to Azure PaaS services such as Storage Accounts, SQL Databases, or Key Vaults. [Shailaja Beeram](https://www.linkedin.com/in/shailaja-beeram-82324310a/) Enterprise Cloud Architect @ Edenred USA Azure service [Azure Private Link](https://www.pointfive.co/efficiency-hub/cloud-services/azure-private-link) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0318 Type Idle or Unused Resource ## Explanation Why the waste happens and who it affects. When the target service behind a private endpoint is deleted, migrated, or replaced, the private endpoint itself is not automatically removed. Instead, it transitions to a disconnected state and persists as an orphaned network resource that continues to incur hourly charges. Because private endpoints are network-layer resources managed separately from the application resources they connect to, they are frequently overlooked when services are decommissioned - particularly when the service owner and the network owner are different teams. This pattern is especially common in development and testing environments where resources are created and destroyed frequently, but networking components are not consistently cleaned up as part of the resource lifecycle. It also occurs during production migrations, service replacements, or architecture changes. Over time, these orphaned endpoints accumulate silently - occupying private IP addresses in subnets, contributing to IP address exhaustion, and generating ongoing charges with no functional benefit. Because each private endpoint maps to a specific target resource and subresource (for example, separate endpoints are required for blob versus file storage on the same storage account), even a single decommissioned service can leave behind multiple orphaned endpoints. ## Billing model The pricing dimensions that drive this cost. Azure Private Endpoint billing is based on two components: A per-endpoint hourly charge Incurred continuously from the moment the private endpoint is created until it is explicitly deleted, regardless of whether the target resource still exists or whether any traffic is flowing through the endpoint. Partial hours are charged as full hours. Data processing charges Applied to both inbound and outbound data processed through the private endpoint, with tiered pricing based on volume. These charges are only relevant when the endpoint is actively routing traffic. A private endpoint in a disconnected or orphaned state generates zero data processing charges but continues to accrue the fixed hourly endpoint charge indefinitely. This charge persists until the endpoint resource is manually deleted by the endpoint owner. There is no automatic cleanup mechanism or grace period for disconnected endpoints. ## How to detect 6 checks to find it in your estate. - Identify private endpoints in a disconnected connection state, which indicates the target resource or its private endpoint connection has been removed - Review private endpoints whose associated target resources (such as storage accounts, databases, or key vaults) no longer exist in the subscription or have been migrated - Assess virtual network subnets for private endpoints that are not associated with any currently active workload or application - Evaluate private endpoint inventories across development, testing, and staging environments where resource turnover is high - Examine private endpoints that show no data processing activity over a representative period, indicating they are not routing any traffic - Confirm with application and platform teams whether flagged private endpoints are still required for planned or future use ## How to fix 5 ways to remove the waste. - Delete private endpoints that are in a disconnected state or whose target resources no longer exist, as these endpoints serve no functional purpose and cannot be reconnected - Incorporate private endpoint cleanup into service decommissioning procedures so that when a target resource is deleted or migrated, its associated private endpoints are reviewed and removed as part of the same process - Establish periodic infrastructure audits that specifically include networking resources such as private endpoints, ensuring orphaned resources are identified and removed before they accumulate - Implement tagging and ownership conventions for private endpoints that link them to the application or service they support, making it easier to identify orphaned resources when services change - Use automated governance checks to detect and alert on private endpoints in a disconnected state or with no associated target resource, enabling timely remediation ## Documentation Vendor references for pricing and configuration. - [What is a private endpoint? - Azure Private Link learn.microsoft.com](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview) - [What is Azure Private Link? learn.microsoft.com](https://learn.microsoft.com/en-us/azure/private-link/private-link-overview) - [Pricing - Azure Private Link azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/private-link/) - [Manage Azure private endpoints - Azure Private Link learn.microsoft.com](https://learn.microsoft.com/en-us/azure/private-link/manage-private-endpoint) - [Azure Private Link Cost Optimization Principles learn.microsoft.com](https://learn.microsoft.com/en-us/azure/private-link/private-link-cost-optimization) - [Azure Orphan Resources - Microsoft Tech Community techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/fasttrackforazureblog/azure-orphan-resources/3492198) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure NAT Gateway CER-0319 ### [Idle Azure NAT Gateway Attached to Subnet Without Active Workloads](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-azure-nat-gateway-attached-to-subnet-without-active-workloads) Azure NAT Gateways are commonly deployed to provide outbound internet connectivity for resources within virtual network subnets. Over time, the workloads that originally required this outbound access may be scaled down, migrated, or... Networking - Azure Bastion CER-0312 ### [Idle or Underutilized Azure Bastion Deployment](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-or-underutilized-azure-bastion-deployment) Azure Bastion incurs continuous hourly charges from the moment it is deployed until the resource is deleted - regardless of whether any connections are actively being made. This means a Bastion host sitting idle in a development or test... Networking - Azure Load Balancer CER-0292 ### [Idle Azure Load Balancers in Non-Production Environments](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-azure-lb-in-non-prod-env) Azure Load Balancers remain provisioned after the backend workloads they supported have been scaled down, stopped, or decommissioned. This is common in non-production environments where virtual machines are shut down outside business... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.