Azure finding review guides.

Eleven Azure finding guides that explain what the signal means, what Costframe checks, why it might be wrong, how to remediate safely, what rollback requires, and how finance should verify the result.

11 resource-specific reviews · Customer-controlled changes

Start with the signal you need to explain.

Review by resource type

Storage

CF-AZ-ST-01 · Storage

Unattached managed disk

An Azure managed disk remains allocated and billable but is not currently attached to a virtual machine. Unattached is a strong signal, not automatic permission to delete data.

High potential impact→

CF-AZ-ST-06 · Storage

Old snapshot

A snapshot is older than an organization’s documented recovery or retention window and appears to have no active legal, compliance, forensic, or recovery purpose. Age alone never proves a snapshot is safe to delete.

Medium potential impact→

CF-AZ-ST-09 · Storage

Hot-tier storage candidate

Blob data is a cooler-tier candidate when access patterns, retention needs, retrieval latency, minimum-duration rules, and total cost indicate Hot is no longer the right tier. Lower storage price alone is not the decision.

Medium potential impact→

Compute

CF-AZ-CP-02 · Compute

Oversized virtual machine

A VM is a rightsizing candidate when observed demand and known workload constraints may fit a less expensive compatible SKU with safe headroom. No single CPU threshold proves a production VM is oversized.

High potential impact→

CF-AZ-CP-03 · Compute

Stopped-but-billing VM

A VM stopped from inside the guest can remain allocated. Compute billing generally stops only when Azure reports the VM as deallocated; attached disks, public IP configurations, and other resources may still bill after deallocation.

High potential impact→

Networking

CF-AZ-NW-04 · Networking

Unused public IP

A public IP resource has no current Azure association that justifies its recurring charge. An empty direct association is useful evidence, but DNS, firewall, allowlist, IaC, or future failover dependencies can exist outside that relationship.

Medium potential impact→

CF-AZ-NW-05 · Networking

Idle load balancer

A load balancer may be idle when backend pools, health, flows, and workload context show it no longer serves a live path. Empty pools are stronger evidence than low traffic, but neither automatically proves deletion is safe.

Medium potential impact→

PaaS

CF-AZ-PS-07 · PaaS

Empty App Service plan

An App Service plan has no currently associated apps or slots but still carries provisioned compute cost. Empty membership is strong evidence, yet deployment, IaC, networking, and planned reuse must be checked.

High potential impact→

Database

CF-AZ-DB-08 · Database

Underused SQL database

An Azure SQL database is a downsizing or consolidation candidate when representative compute, storage, IO, concurrency, and latency evidence suggests a lower service objective can meet the workload with safe headroom.

High potential impact→

Commitments

CF-AZ-CM-10 · Commitments

Reservation coverage gap

Eligible stable usage is not covered by an existing reservation or equivalent commitment. A coverage gap is an analysis prompt—not an automatic purchase recommendation.

High potential impact→

Governance

CF-AZ-GV-11 · Governance

Cost anomaly

A cost anomaly is an unexpected change relative to an appropriate historical and business baseline. It can be a harmful runaway event, an intended deployment, delayed billing, a credit change, or normal seasonality; anomaly does not mean waste.

High potential impact→

Prepare the review before changing Azure

Bring the resource ID, current billing basis, observation window and workload owner. Read each guide's false-positive checks and recovery requirements. An empty resource association can miss external dependencies; quiet utilization can miss a business cycle.

Keep partial or stale source coverage visible. Inventory is not a deletion approval, and a catalog estimate is not a verified invoice reduction. Costframe collects read-only evidence; customer teams approve and execute changes.