Deallocating idle VMs: the basics
What does an idle or oversized Azure VM actually cost you?
A running virtual machine bills for its compute size every hour whether or not anyone is using it. Idle and underutilised waste shows up in a few distinct shapes rather than one setting. A machine can sit at single-digit CPU all week because the workload moved on but nobody turned it off. A dev or test box can run nights and weekends when no one is logged in. A production VM can be three sizes larger than its real load because someone picked a generous SKU once and never revisited it. Each is the same underlying problem: you are paying for cores and memory you are not using.
Azure Advisor turns this into a single cost recommendation, 'Optimize virtual machine (VM) or virtual machine scale set (VMSS) spend by resizing or shutting down underutilized instances', also written as 'Right-size or shutdown underutilized virtual machines'. Advisor watches utilisation over a lookback period and flags machines whose CPU and outbound network sit below a threshold, with the default rule being CPU at or below five per cent. It then gives you two routes: shut the machine down if the workload no longer needs it, or resize it to a smaller, cheaper SKU if it does.
Most of this waste is drift, not intent. A proof-of-concept that became permanent, a batch box that finished its job, an autoscale baseline that was set too high and never tuned. The work is to find every machine that is idle or oversized, decide which can be switched off entirely, which should be resized, and which should simply run on a schedule, then make the saving stick so the same machines do not quietly creep back to running full-time.
In this lesson you will learn how Azure expresses idle and oversized virtual machine spend, how to find every wasteful machine in a subscription through Advisor and a direct utilisation query, and how to deallocate, resize or schedule them without breaking the workloads that are genuinely in use. You will see why a deallocated VM stops billing for compute, what residual cost remains, and how to make the saving stick rather than letting machines drift back to running full-time.
The five-per-cent machine that ran for a year
Azure Advisor's default rule for flagging an underutilised VM is strikingly low: it looks for machines whose CPU sits at or below five per cent and whose outbound network is minimal across the lookback period. That bar is deliberately conservative, because a machine that quiet is almost certainly not earning its keep, yet idle VMs routinely run for months or longer before anyone notices. The reason is simple: nothing breaks when a VM is idle, so nothing prompts a human to look. A machine at ninety-five per cent idle behaves exactly like a machine at ninety-five per cent busy from the outside. It just keeps billing, every hour, until someone reads the list Advisor has been quietly maintaining.
Finding idle and oversized VMs across a subscription
Priya runs the platform team at a scale-up that has grown its Azure footprint faster than anyone has had time to tidy. Azure Advisor shows a cost recommendation flagging a cluster of virtual machines as underutilised, with a potential yearly saving attached.
Rather than work the list machine by machine, Priya starts by pulling the Advisor cost recommendations and cross-checking them against live power state and utilisation, so the genuinely idle machines can be told apart from the merely oversized before anything is switched off.
Start by pulling the Advisor cost recommendations for the subscription. These are the machines Azure already considers wasteful.
A machine Advisor flags as underutilised that you also recognise as a finished proof-of-concept is the highest-value target: switch it off entirely, not just resize it.
How Azure decides a VM is underutilised, and what deallocating actually doesdeep dive
Azure Advisor evaluates virtual machine utilisation over a lookback period and flags a machine as underutilised when its metrics stay below a threshold. The default rule looks for CPU at or below five per cent together with low outbound network, and the rule is configurable per subscription: the CPU threshold can be set to 5, 10, 15 or 20 per cent and the lookback window to 7, 14, 21, 30, 60 or 90 days, so you can tune Advisor to surface more aggressive savings or only the most clear-cut cases. For its resize recommendations Advisor also considers P95 of CPU, not just the average, so a machine with occasional spikes is recommended a SKU that still covers the peak.
The billing mechanics are what make the saving real, and they hinge on a distinction that trips people up. A VM stopped from inside the guest operating system enters 'Stopped (Incurring Charges)': the machine is off but Azure still reserves the cores and memory for it, so you keep paying the compute rate. A VM stopped through Azure, with az vm deallocate or the portal, enters 'Stopped (deallocated)': Azure releases the underlying hardware and the compute charge stops. The disks attached to the machine keep billing in either state, because the storage is still provisioned, but that is a small fraction of the compute you were paying for.
This is why the route matters. Deallocating is the action that actually stops the meter, and it is reversible: the machine keeps its disks, its configuration and, for most SKUs, its private IP, so it starts back up as the same machine. Resizing changes the SKU to a smaller one and takes effect on the next start. The strongest position combines a one-off sweep of the current list with an ongoing mechanism, an auto-shutdown schedule for non-production and a recurring review of the Advisor list, so the saving is enforced rather than rediscovered every quarter.
What is the impact of leaving idle VMs running?
The direct impact is wasted spend that compounds. A single oversized or idle VM is a modest line item, but a fleet of them running around the clock is a material slice of the compute bill, and every hour they run is money spent on cores and memory that do no work. Because nothing breaks when a machine is idle, the waste is silent: it does not page anyone, it does not slow anything down, it simply accrues on the invoice until someone acts on it.
The second-order impact is run-rate creep. Idle machines that are never reviewed become the baseline, so next year's budget is built on top of this year's waste. Harvesting the idle-compute list resets that baseline to what the estate actually uses, which makes every forecast and every reservation or savings-plan commitment more accurate, because you are sizing commitments to real demand rather than to machines that should not be running.
On the optimisation side, idle VMs are also the cleanest possible candidate for the wider efficiency toolkit. Once the genuinely idle machines are off and the oversized ones are resized to their real load, the remaining steady-state fleet is what you base reserved instances and savings plans on. Acting on the idle list first means you do not lock in a one or three year commitment against a machine you were about to switch off.
How do you harvest idle-VM savings safely?
Work the capability as one loop rather than chasing individual machines. The order matters: confirm a machine is genuinely idle before you switch it off, so you do not take a workload offline that someone quietly depends on.
1. Inventory every flagged machine
Pull the Advisor cost recommendation for the subscription and cross-check it against live power state and utilisation. Treat this inventory as the source of truth: Advisor tells you what is underutilised, and the power-state check tells you what is already stopped versus still billing, so you do not chase machines that are off but not deallocated.
2. Sort into deallocate, resize and schedule
For each machine, decide its route. A machine with no remaining job is a deallocation: the full compute saving, no trade-off. A machine that is oversized but in use is a resize: smaller SKU after a quick check against P95 load. A machine that is only needed in working hours is a schedule: it runs by day and deallocates itself at night.
3. Act, risk-free first
Deallocate the finished machines, because that is the action that actually stops the compute meter, not an OS-level shutdown. Resize the oversized ones to the SKU Advisor recommends. Each change is a single command per machine and the saving lands at the next billing interval. Confirm anyone who might depend on a machine before switching it off.
4. Make the saving stick with a schedule
For non-production fleets, attach an auto-shutdown schedule so the machines deallocate themselves outside working hours rather than relying on someone remembering. Pair this with a recurring review of the Advisor list, so new idle machines are harvested as they appear rather than rediscovered next quarter.
# 1. Find running VMs that Azure considers underutilised, then deallocate the ones with no remaining job.
# -d adds the live power state; this stops the COMPUTE meter (an OS shutdown does not).
for id in $(az vm list -d \
--query "[?powerState=='VM running'].id" -o tsv); do
echo "Deallocating $id"
az vm deallocate --ids "$id" --no-wait
done
# 2. Resize an oversized but in-use VM to the SKU Advisor recommends (takes effect on next start).
az vm resize \
--resource-group rg-platform \
--name prod-api-01 \
--size Standard_D2s_v5
Quick quiz
Question 1 of 5Azure Advisor flags a cluster of VMs under 'Right-size or shutdown underutilized virtual machines'. What is the most efficient way to think about the list?
You scored
0 / 5
Keep learning
Go deeper on how Azure surfaces idle and oversized virtual machine spend and how to act on it across the fleet.
- Optimise VM or VMSS spend by resizing or shutting down underutilised instances The Advisor cost recommendation behind this lesson, including the default utilisation rule and how to act on it.
- States and billing of Azure Virtual Machines Why a deallocated VM stops billing for compute while a stopped (allocated) one does not, and what disks still cost.
- Configure recommendations in Azure Advisor How to tune the CPU threshold and lookback window so Advisor surfaces the savings you want to see.
You can now treat idle and oversized virtual machines as one capability rather than a scatter of tickets: inventory what Advisor flags, sort each machine into deallocate, resize or schedule, act on the risk-free deallocations first because that is the action that actually stops the compute meter, and make the saving stick with an auto-shutdown schedule and a recurring review. You also know why a deallocated machine stops billing for compute while an OS-level shutdown does not, and that the only residual is the small disk charge.
Back to the library