Find and Clean Up Orphaned Azure Resources

Use the Orphaned Resources page in Atlas AVD to find unattached disks, unused IPs, stale snapshots and other leftovers that still cost money, and more.

Before you begin

  • The Manage host pools permission (pool.manage) to open Orphaned Resources. Administrators and Operators have it
  • An Administrator role to delete resources, remove resource locks, remove orphaned session hosts, or manage Cleanup Policies
  • Atlas AVD connected to your Azure subscriptions

Where to find it

  • Financial → Orphaned Resources in the left sidebar.
  • Resources → Cleanup → Orphaned Resources shows the same page as a tab of the Resources hub.
  • Resources → Governance → Cleanup Policies is where scheduled, report-only scans are set up (see below).

What it finds

Atlas AVD scans your subscriptions with Azure Resource Graph and flags resources that nothing is using. The detection is deliberately cautious: when Atlas cannot be sure a resource is unused, it leaves it out rather than risk you deleting something live.

  • Disks: managed disks that are not attached to any VM.
  • NICs: network interfaces not attached to a VM. Interfaces that belong to a private endpoint are never flagged.
  • Public IPs: addresses not associated with a NIC, load balancer, NAT gateway, Azure Firewall or Application Gateway.
  • Snapshots: snapshots whose source disk (or source snapshot) no longer exists, and that are more than 90 days old.
  • NSGs and route tables: network security groups and route tables not associated with any NIC or subnet.
  • Availability sets: sets with no VMs in them.
  • Load balancers: load balancers with no backend members.
  • Orphaned session hosts: AVD host pool registrations whose VM has been deleted. These appear in their own card at the top of the page, because removing a registration is different from deleting an Azure resource.

Scan results are cached for 15 minutes so the page loads quickly. Use the refresh button in the page header to force a fresh scan, for example straight after you have cleaned something up in the Azure portal.

Reading the page

  • Summary cards across the top: the total number of orphaned resources, disks (with the number of snapshots underneath), NICs and IPs, and the estimated monthly cost of everything found, with the time of the last scan.
  • Filter chips by resource type, each with a count. Click a chip to show only that type and click it again (or Clear) to show everything. The search box matches name, resource group and location.
  • Monthly Cost for each resource: a live Azure list price where one is available, otherwise an estimate. NSGs, route tables and NICs have no Azure charge of their own and show Free. Click a cost to see how it was worked out.
  • Locked shows any Azure resource locks that cover the resource, including locks inherited from its resource group or subscription.
  • Click a resource name to open it in the Azure portal, or its resource group to see everything else in that group.

Use the export menu to download the list as CSV, Excel or PDF, for example to get sign-off from a resource owner before deleting. The Orphaned Resources Report on the Reports page can also be emailed on a schedule.

Before you delete: a safety checklist

Deleting a resource from Azure is permanent. A minute of checking is worth it.

  1. Check the Locked column. A lock is usually there on purpose. Find out who added it and why before removing it.
  2. Treat snapshots with care. A "stale" snapshot may be the only backup of a disk someone deleted on purpose. Check the snapshot's tags and name, and ask its owner if you are not sure.
  3. Check tags and the resource group. Resources tagged for a project, a legal hold or disaster recovery may be kept deliberately.
  4. Check the Date Created. Something created in the last few days may belong to a deployment that is still in progress.
  5. Confirm the public IP is not referenced elsewhere, such as in a DNS record or a partner's firewall allow-list. Once released, the same address cannot be got back.
  6. If in doubt, export the list and share it with the resource owners first.

Deleting resources

Deleting is available to administrators only. Other roles see the same list, but without selection checkboxes.

  1. Tick the resources you want to remove. The tick box in the header selects everything that matches the current filter.
  2. Click Delete (N) in the page header.
  3. Review the confirmation, which shows how many resources will be removed and the estimated monthly saving, then confirm.
  4. Atlas AVD deletes the resources from Azure and refreshes the scan. Rows show Deleting until Azure finishes removing them, and a status banner reports what succeeded and, for anything that failed, why.

Deleted resources cannot be recovered. Azure refuses to delete a resource that is covered by a lock, so remove the lock first (see below) or leave that resource out.

Removing a resource lock

If a resource is locked, an administrator can click Locked in its row to remove the lock. The confirmation lists every lock that applies.

If a lock is inherited from the resource group or subscription, removing it unlocks every resource that lock protects, not just this one. In that case it is usually better to remove the resource in the Azure portal, or ask whoever owns the lock.

Removing orphaned session hosts

When a session host VM is deleted outside Atlas AVD, its registration can linger in the host pool. These hosts are listed in their own card. An administrator can select them and click Remove to delete the stale registrations. No Azure resource is deleted, because the VM is already gone. If AVD still records user sessions on a host, the first attempt is refused and Atlas offers Force remove, which discards those stale sessions after a second confirmation.

Cleanup Policies: scheduled, report-only scans

Cleanup Policies watch for orphaned resources on a schedule, so you hear about leftovers without having to remember to check. They are report-only: a policy never deletes anything. Administrators manage them under Resources → Governance → Cleanup Policies.

  • Resource types: which kinds of orphaned resource the policy looks for.
  • Min age (days): only report resources older than this (30 days by default).
  • Exclude tag keys: resources carrying any of these tag keys are always skipped. Tag resources you want to keep, for example with a keep tag, and add that key here.
  • Email recipients: who receives the digest.
  • Enabled: Atlas evaluates each enabled policy daily and emails a digest of what it found.
  • Preview runs a dry run and shows what the policy would report right now. Run now evaluates it immediately, and the run history shows recent scheduled and manual runs.

Policies only ever report. Deleting is always a deliberate step taken by an administrator on the Orphaned Resources page.

Troubleshooting

  • You do not see Orphaned Resources in the sidebar: your role does not include Manage host pools. Ask an administrator.
  • There are no checkboxes or Delete button: only administrators can delete. Ask an administrator to do it, or to change your role.
  • A resource you just deleted in the Azure portal is still listed: the scan is cached for up to 15 minutes. Click refresh.
  • A delete failed: read the reason in the status banner. The most common causes are a resource lock, or a resource Azure still considers in use.
  • The page says Azure is not configured: Atlas AVD cannot reach your subscriptions. Use Check again in the banner, or check the app registration's access.

Next steps