📝 Azure Public IP Address is not associated with any resource 🟢

• Contextual name: 📝 Public IP Address is not associated with any resource 🟢
• ID: /ce/ca/azure/virtual-network/unused-public-ip-address
• Located in: 📁 Azure Virtual Network

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY
  • COST

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Azure Public IP Address
  • 🔌 Azure Public IP Address - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Evaluate and remove Azure Public IP Addresses that are not currently associated with any Azure resource to minimize unnecessary costs and reduce resource clutter.

Rational

Unassociated Public IP Addresses in Azure incur charges on an hourly basis despite not being attached to any active service. Proactively identifying and deallocating these unused IPs is an effective cost-optimization strategy.

Beyond cost implications, unassociated Public IPs may represent residual network exposure. While they do not directly expose a running workload, their presence can complicate network visibility, increase the attack surface, and hinder security posture management. Eliminating unused public IPs contributes to a cleaner, more secure, and manageable cloud environment.

Audit

This policy marks an Azure Public IP Address as INCOMPLIANT if the Associated Resource ID field is empty, indicating no active associations with IP Configurations.

Remediation

Open File

Remediation

Deallocate the Unused Public IP Address

If a Public IP Address is confirmed to be unused and not required by any current or planned service, it should be deleted to prevent ongoing charges and reduce the potential network exposure.

Azure CLI

az network public-ip delete \
    --resource-group {{resource-group-name}} \
    --name {{public-ip-name}}

PowerShell

Remove-AzPublicIpAddress `
    -Name "{{public-ip-name}}" `
    -ResourceGroupName "{{resource-group-name}}"

Considerations

• Ensure that the Public IP Address is not reserved for future use or linked to a pending deployment. Accidental deletion may cause disruption to planned services.
• If the Public IP was recently detached due to the deletion of a dependent resource, verify that the resource removal was intentional and permanent.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 Cloudaware Framework → 💼 Public and Anonymous Access			77
💼 Cloudaware Framework → 💼 Waste Reduction			10