Is an unassociated public IP address still billed?

Yes, if it is static. A static public IP is billed from the second hour after it is created until it is deleted, whatever it is or isn't attached to. Standard SKU IPv4 addresses don't offer dynamic allocation, so unattached ones keep costing money.

Can we downsize a client's oversized VPN gateway?

Usually, yes. Microsoft supports moving down as well as up within the same SKU family. Basic gateways can't be resized: changing one means deleting and recreating it, with downtime and a new public IP.

Can we stop Azure Firewall out of hours for dev and test?

Yes. You can deallocate a firewall with Azure PowerShell and allocate it again later, and billing stops and restarts with it. The firewall's private IP may change when it comes back, so check routing after each restart.

Coverage

Azure networking cost optimisation for MSPs

Many Azure networking resources carry hourly or monthly charges whether or not any traffic flows, so a gateway with no connections or an ExpressRoute circuit never completed with the provider keeps adding to the bill long after anyone needed it.

19

automated finders for networking

Read-only, across every connected client tenant, tied to real billing data.

Modernise
Remove unused
Rightsizing

Where networking spend goes to waste

The main cost levers Microsoft documents for networking, and the ones an MSP should check across every client.

Delete orphaned IPs and idle gateways

Static public IPs are charged whether or not they're attached, and NAT gateways and virtual network gateways bill by the hour even when nothing uses them. They are commonly left behind after VMs are deleted or migrations finish, and Microsoft's FinOps guidance includes Resource Graph queries to find each type. ^[2]

Rightsize and stop idle Application Gateways

Base the v2 minimum instance count on observed autoscaling trends rather than worst-case guesses, and compare billed capacity units with actual utilisation. Delete gateways with empty backend pools, and stop dev and test gateways out of hours, because a stopped gateway doesn't incur charges. ^[3]

Match Firewall tiers and share hub instances

Choose the Azure Firewall tier per client: Basic for smaller environments, Standard for most, Premium for highly sensitive workloads. Instead of a firewall per spoke, run one central instance in the hub and share it with spokes in the same region. ^[4]

Remove idle ExpressRoute circuits

ExpressRoute circuits are billed from the moment they are created, so deprovision and delete any unused circuit. Size circuit SKU and bandwidth to real demand, choose the data plan deliberately, and review bandwidth periodically. ^[5]

Pick the right Front Door tier and cache

Front Door Standard is the more cost-effective tier for moderate traffic, while Premium adds features such as managed WAF rules and Private Link at a higher rate. Cache content that changes infrequently and enable compression to cut billable bandwidth. ^[6]

Keep traffic in-region

Inbound data and traffic within a single availability zone are free, but moving data between Azure regions is charged per GB, so keep chatty workloads and their dependencies in the same region. Internet egress is billed after the first 100 GB each month. ^[7]

How Cerberus Cloud covers networking

Cerberus Cloud runs 19 automated finders for networking across every connected client tenant. Each one ties a technical signal to real billing data, so findings arrive with an estimated recoverable value, ranked by impact, effort and risk, with evidence and remediation scripts for your engineers to review.

Access is read-only, so nothing changes in a client environment until your team decides it should. See how it works or the multi-tenant portfolio view.

Modernise
Remove unused
Rightsizing

Frequently asked questions

Is an unassociated public IP address still billed?: Yes, if it is static. A static public IP is billed from the second hour after it is created until it is deleted, whatever it is or isn't attached to. Standard SKU IPv4 addresses don't offer dynamic allocation, so unattached ones keep costing money.
Can we downsize a client's oversized VPN gateway?: Usually, yes. Microsoft supports moving down as well as up within the same SKU family. Basic gateways can't be resized: changing one means deleting and recreating it, with downtime and a new public IP.
Can we stop Azure Firewall out of hours for dev and test?: Yes. You can deallocate a firewall with Azure PowerShell and allocate it again later, and billing stops and restarts with it. The firewall's private IP may change when it comes back, so check routing after each restart.

See networking findings on a sample portfolio

A 15-minute walkthrough: tenant connection, prioritised findings, remediation scripts and savings history.

Book a Walkthrough All coverage

Sources

Last checked 15 October 2026. Product details change; tell us if something here is out of date.

All 15 coverage families