Idle Private Endpoint (Azure)
CostLens finds Azure private endpoints with no approved private-link connection — billed hourly while connected to nothing.
CostLens finds idle Azure private endpoints — endpoints with no approved private-link connection. A private endpoint bills an hourly rate regardless of use, so one that's rejected, disconnected, or left over after its target service was removed is pure waste.
Deletion is irreversible
Deleting a private endpoint removes its NIC and IP binding. CostLens treats this as an irreversible action — keep it if a connection is about to be approved.
How it works
Private endpoints are enumerated
CostLens lists private endpoints via the Azure Resource Manager API and inspects each one's private-link service connections.
Unconnected endpoints are flagged
Endpoints with no connection in the Approved state are surfaced, priced at the private-endpoint hourly rate.
What to do
- Confirm no connection request is pending approval on the target service.
- Delete the endpoint (or approve/repair its connection) in the Azure portal to stop the charge.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| critical | >$500 |
| high | $100–$500 |
| medium | $20–$100 |
| low | <$20 |
Required permissions
- Detect:
Reader— see Azure Accounts.
Limitations
- Flags endpoints with no
Approvedconnection — a pending request that's about to be approved will show until it connects. - The estimate covers the endpoint hourly rate; private-link data-processing charges are billed separately.