Skip to content
Azure finding library
CF-AZ-ST-01/Azure StoragePotential impact: High

How to review an Azure unattached managed disk

An Azure managed disk remains allocated and billable but is not currently attached to a virtual machine. Unattached is a strong signal, not automatic permission to delete data.

Resolve the detached disk's retention purpose

Who reviews this signal?

Accountable owner
Storage / workload owner
Review cadence
Weekly

Check observation dates and read-only scope. Your team approves and implements changes outside Costframe.

How this finding happens

  • →A VM is deleted while its OS or data disk delete option preserves the disk.
  • →A migration, restore, or blue/green deployment leaves a temporary disk behind.
  • →An owner intentionally retains a detached disk as a recovery point but never adds an expiry policy.

Collected evidence and verification limits

Checked when available

  • ✓Managed disk resource ID, subscription, region, SKU, size, and current diskState
  • ✓ManagedBy / attachment reference and current resource relationship
  • ✓Creation and last observed timestamps
  • ✓Current catalog price when a matching regional SKU is available

Not always verifiable

  • —Azure resource state does not prove whether the data is still required.
  • —The platform may not know an external recovery, litigation, or retention obligation.
  • —List price is not the same as the customer’s billed net cost.

Missing or stale evidence is a limitation, not a passed check.

Why this finding might be wrong

These conditions lower confidence or require manual owner review before action.

  • A deliberately detached disaster-recovery disk
  • A disk between deployment stages or awaiting attachment
  • A retained forensic, compliance, or legal-hold copy
  • A disk referenced by an external runbook not visible in Azure relationships

Plan the change and recovery path.

  1. Identify the resource owner from tags, deployment history, IaC, or the parent workload.
  2. Check snapshots, backup policy, encryption/key dependencies, locks, and retention obligations.
  3. Create or confirm a recovery copy only if policy requires it; record its expiry.
  4. Delete through the normal change process, then confirm the meter disappears.

Rollback / recovery

Deletion is not a reversible resize. The rollback is restore from a verified snapshot or backup, so that recovery path must be tested before deletion.

How savings are calculated

Estimated net monthly saving = the disk’s current net monthly charge. Catalog list value may be shown separately; do not discount ActualCost again.

Do not quote a quantified saving when the billing scope, pricing basis or required workload evidence is incomplete or stale. Treat a modeled amount as estimated until suitable billed outcomes support it.

Check the billed outcome

Disk is absent and its billed meter no longer appears after the provider’s normal data delay.

Your next task

Resolve the detached disk's retention purpose

Take the disk ID, attachment state and last-known workload to the storage owner. Record whether it is a recovery copy, a migration artifact or genuinely retired data. Confirm the backup can be restored and that no legal hold applies before requesting deletion.

Check the recovery copies too

If the owner cannot resolve a dependency or recovery requirement, keep the candidate in review rather than treating it as approved.

Related Azure findings