Cut your Azure bill. Not your reliability.
A line-by-line review of your Azure estate that shows exactly where the money goes, isolates the waste, and removes it in phases - lowest risk first. Every saving comes with how it was found, what it takes to fix, and who needs to sign it off.
Read-only access for the review. Nothing changes until you approve it.
What is an Azure cost optimisation review?
An Azure cost optimisation review measures at least 30 days of real spend and utilisation across your subscriptions, breaks it down by resource type and environment, and finds the gap between what you pay for and what you use. The output is a prioritised plan: each action with its annual saving, its prerequisite, its risk, and the stakeholder who has to approve it.
Most Azure waste isn't one big mistake. It's hundreds of small, reasonable decisions - a test VM left deallocated, a log level left on Verbose, a disk sized for a launch that never came - that nobody owns once the project ends. Industry surveys such as Flexera's annual State of the Cloud report consistently find organisations estimate that around a quarter or more of their cloud spend is wasted.
Where Azure spend usually hides
- Virtual machines and managed disks - typically the two largest lines, and the least examined
- App Service plans - previous-generation SKUs and one plan per site
- Non-production at production scale - dev, test, UAT and DR sized like live
- Logging and telemetry - uncapped ingestion and duplicate tools
- Storage and backup - cold data on hot, geo-redundant tiers
- No commitment discounts - steady workloads billed at pay-as-you-go
Four phases, ordered by risk
Each phase is independently deliverable. You bank the safe savings first and make the bigger decisions with evidence, not guesswork.
Housekeeping: stop the leaks
Resources that outlived their purpose, and settings that let costs grow without a ceiling. This phase often saves less than later ones, but it closes exposures that can keep growing while everything else is being analysed.
Uncapped Log Analytics ingestion
- Find
- Workspaces with no daily cap (
dailyQuotaGb = -1) and no alert on ingestion volume. Log Analytics bills per GB, so one verbose deployment or retry loop becomes unbounded spend. - Fix
- Daily caps sized to real use, with alerts well before the cap is hit. Instantly reversible - and the first thing to do.
Paid log retention nobody reads
- Find
- Workspaces retaining data beyond the included 31 days. Retention set on workspace-backed Application Insights components isn't what bills - the workspace is.
- Fix
- Retention matched to how far back anyone actually queries, with longer-term needs moved to archive.
Orphaned disks, snapshots and NICs
- Find
- Unattached managed disks, snapshots older than 90 days, network interfaces with no VM, and App Service plans hosting no apps.
- Fix
- Removal - after checking backup vault policies, because some
azurebackup_*snapshots are still live restore points.
Dead monitoring components
- Find
- Workspaces with zero ingestion, classic Application Insights components (retired February 2024), and duplicates left by repeated portal deployments.
- Fix
- Delete - while excluding components that belong to security tooling, which should never be removed as clutter.
Idle gateways and empty resource groups
- Find
- VPN gateways with no connections, and resource groups with nothing in them.
- Fix
- Idle gateways removed for a direct saving. Empty groups removed for governance - they cost nothing, but signal there's no decommissioning process.
Missing or wrong tags
- Find
- Plans and VMs with an absent or incorrect
environmenttag, which quietly misreport production and non-production spend. - Fix
- Corrected tags plus Azure Policy to keep them correct, so cost reports can be trusted from here on.
Configuration: same workload, cheaper settings
Many Azure savings need no redesign at all - just a current-generation SKU, the right tier, or a setting that matches what the environment is actually for.
Previous-generation App Service plans
- Find
- Plans still on Premium v2 (P1v2 and up). Premium v3 often costs less per instance and offers more memory - P1v3 roughly doubles P1v2's specification.
- Fix
- Move to P0v3 or P1v3 - after checking VNet integration, deployment slots and scaling still hold on the target.
Logic Apps integration accounts in dev and test
- Find
- Paid integration accounts billing a flat monthly fee in non-production environments.
- Fix
- Retire them or move to the Free tier, which Microsoft provides for development and testing.
Duplicate and noisy telemetry
- Find
- Application Insights running alongside another APM tool, and a per-table breakdown of ingestion: traces at Verbose or Information, high-cardinality custom metrics, chatty dependency tracking.
- Fix
- Raise the minimum log level to Warning, trim custom metrics, and decommission duplicate telemetry in non-production.
Deallocated VMs still paying for disks
- Find
- Stopped (deallocated) VMs - often finished test exercises - whose OS and data disks keep billing in full.
- Fix
- Identify owners, snapshot if restore matters, then delete. A snapshot held for a defined period costs a fraction of the disk it replaces.
Storage that can't be tiered
- Find
- General-purpose v1 storage accounts, which can't use access tiers or lifecycle management - often a log store that has grown since day one with no expiry.
- Fix
- Non-disruptive in-place upgrade to v2, then lifecycle policies that expire or tier data automatically.
Cold data on hot, premium, geo-redundant storage
- Find
- Accounts holding real volume with almost no transactions - backups and archives on Hot, Premium block blob holding cold data, and GRS in non-production.
- Fix
- Move to Cool or Archive, Premium to Standard, and GRS to LRS where the data is reproducible.
Rightsizing: pay for what you use
Capacity is usually provisioned to a standard, not measured. Thirty days of utilisation data shows the real requirement - and that evidence is what lets each change be signed off safely.
Over-provisioned disk performance
- Find
- Premium SSD v2 disks whose consumed IOPS and throughput sit well below what's provisioned - billed as separate meters from capacity. Identical prices across many disks are the giveaway.
- Fix
- Lower provisioned IOPS and throughput online with no downtime; move SQL TempDB to local or ephemeral SSD, which carries no managed disk charge.
WAF gateways in every environment
- Find
- Application Gateway WAF_v2 deployed per environment, including dev, test and training.
- Fix
- Consolidate non-production gateways and use a lower tier where WAF protection isn't needed.
Oversized production App Service plans
- Find
- The most expensive plans compared with their measured CPU and memory - often already flagged by Azure Advisor as underutilised.
- Fix
- Step down a size or instance count, with autoscale rules to absorb peaks.
One plan per site
- Find
- Many single-site Standard and Basic plans in non-production - each one an independently billed compute instance.
- Fix
- Consolidate onto shared plans. Apps can only move within the same resource group and region, so this is planned as resource moves or redeployment.
Old VM generations and Windows where Linux will do
- Find
- Previous-generation VM series, and Windows App Service plans running workloads that would run on Linux at a fraction of the price.
- Fix
- Modernise to current VM series; migrate to Linux plans where the application is compatible.
Diagnostic logging at full volume
- Find
- A single network or security workspace taking a large share of all ingestion,
usually 100%
AzureDiagnosticsfrom gateways and firewalls. - Fix
- Resource-specific mode (some tables qualify for the cheaper Basic tier), disable categories nobody consumes, or export to blob storage for compliance.
Business decisions: the biggest numbers
The largest savings are usually not technical. They need someone to decide how much resilience, retention and commitment the business really wants - so each comes with the evidence and the options, not a unilateral change.
Savings plans and reservations
- Find
- Steady compute, App Service, SQL and analytics spend billed at pay-as-you-go rates. Microsoft quotes savings of up to 65% for compute savings plans and up to 72% for reservations.
- Fix
- Commit after rightsizing - otherwise you lock in the waste for one to three years. Usually the largest single saving, with no technical change.
Disaster recovery running hot
- Find
- A DR environment sized like production - its own clusters, gateways and plans - idling until the day it's needed.
- Fix
- Agree the recovery time objective first. If scale-on-failover meets it, most of the standby cost is recoverable.
Backup vaults nobody has reviewed
- Find
- Protected items and restore point collections for machines that no longer exist, non-production backups in geo-redundant vaults, and retention set longer than any recovery requirement.
- Fix
- Retention matched to policy, orphaned protection removed, redundancy matched to the environment.
High-cost resource groups
- Find
- The single most expensive resource groups - often a data, analytics or partner integration platform with its own SQL, VMs and storage that nobody has costed end to end.
- Fix
- A focused review with the owning team, costing the service as a whole rather than resource by resource.
Overlapping network vendors
- Find
- Two SD-WAN or network appliance products running side by side after a migration that never finished.
- Fix
- Confirm the migration state and retire the redundant appliances.
Database sizing across environments
- Find
- Several databases per service - production, weekly copies, multiple UAT instances - each sized independently.
- Fix
- Right-size by environment, retire redundant copies, and consider elastic pools or serverless tiers for intermittent use.
The structural saving
The biggest long-term saving is often architectural - and belongs with a move to an infrastructure-as-code platform rather than piecemeal changes to the old estate.
- Consolidating dozens of App Service plans onto shared Premium v3 capacity with zone balancing
- Consolidating workloads split across regions into one target region
- A keep-or-decommission decision per resource group before importing into Terraform - importing what should be retired adds cost
- Defining the diagnostic logging model once, in the new platform, rather than changing it twice
A cost review is also a health check.
Billing data shows how a system really behaves. Reading it closely regularly surfaces problems that matter more than the money - and they're reported separately, so they don't get lost in a savings spreadsheet.
Persistent production faults
Exception telemetry running at gigabytes a month points to a fault that has been live for weeks - worth fixing on its own merits.
Silent security tooling
A security integration's workspace receiving zero data can mean the integration isn't working at all - flagged to your security function, not deleted.
Governance gaps
Piles of empty storage accounts and resource groups mean there's no decommissioning process. Fixing that stops the waste coming back.
Delivery guardrails
- Nothing is deleted on the first pass. Resources are stopped, snapshotted or tagged for removal first.
- One change category at a time, so any effect is traceable to its cause.
- Rightsizing before commitment. Never buy a reservation for a resource that's about to shrink.
- A named owner and rollback path for every production change.
- A smoke test before and after each change - one health check per tier: gateways, key apps and functions, SQL connectivity.
What you receive
- Where the spend sits - by resource type, environment and subscription, monthly and annual.
- A phased plan - every action with its annual saving, prerequisite, risk and sign-off stakeholder.
- The quick wins - what can be done this week with no service impact.
- The decisions - DR, retention and commitment options with the numbers behind them.
- Findings beyond cost - health, security and governance issues, reported separately.
How the review works
Read-only to start. You decide what happens next.
1) Scope call
Which subscriptions, what you already know, and what's off limits. Scope and fee agreed before any work starts.
2) Read-only access
Reader and Cost Management Reader on the subscriptions in scope. Nothing in your estate is changed.
3) Analysis & plan
Thirty days of cost, utilisation and ingestion data turned into a written, phased plan - walked through with your team.
4) Implement (optional)
Your team runs the plan, or I do - including Terraform or Bicep changes so the savings don't drift back.
Microsoft-certified across Azure DevOps, development, security and data
Azure cost optimisation questions
Broader Azure work?
DevOps, cloud architecture, data and AI integration on Azure and .NET.
ConsultingSmall business on the cloud?
Real 2026 hosting costs and how to avoid a surprise bill.
Hosting costs guideFind out what your Azure bill is really paying for
Tell me roughly what you spend and how many subscriptions you run. I'll tell you whether a review is likely to pay for itself.
