# Idle Virtual Network Gateway Without Connections Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/idle-virtual-network-gateway-without-connections Azure virtual network gateways, both VPN gateways and ExpressRoute gateways, are billed by the hour for as long as they are provisioned, at a rate set... By: PointFive Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) The short version Azure virtual network gateways, both VPN gateways and ExpressRoute gateways, are billed by the hour for as long as they are provisioned, at a rate set by the gateway SKU. PointFive Research Cloud cost research at PointFive Azure service [Azure VPN Gateway](https://www.pointfive.co/efficiency-hub/cloud-services/azure-vpn-gateway) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0416 Type Idle or Unused Resource ## Explanation Why the waste happens and who it affects. The charge does not depend on whether any site-to-site tunnel, VNet-to-VNet link, ExpressRoute circuit or point-to-site client is actually using the gateway, and the public IP addresses attached to the gateway keep billing as well. Gateways are left behind after a data center migration completes, a branch office is closed, an ExpressRoute circuit is decommissioned or a connectivity test ends. Microsoft notes that deleting an ExpressRoute circuit but keeping the gateway still incurs charges until the gateway is deleted. Microsoft's FinOps best practices for Networking include 'Remove idle VNet gateways' with a Resource Graph query, and Azure Advisor has a preview recommendation 'Delete Azure virtual network gateways with no connections'. ## Billing model The pricing dimensions that drive this cost. Gateway charges are fixed by SKU and time, not by traffic. Gateway hours VPN Gateway is billed for the time the gateway is provisioned and available, per SKU; a partial hour is billed as a full hour Included connections The hourly price includes the first 10 site-to-site tunnels and 128 point-to-site connections, with extra tunnels or connections billed separately ExpressRoute gateway Charged hourly in addition to the circuit, and keeps charging after the circuit is deleted Gateway public IPs Static public IP addresses incur charges whether or not they carry traffic ## How to detect 5 checks to find it in your estate. - Run the FinOps best practices Resource Graph query that left-joins microsoft.network/virtualnetworkgateways to microsoft.network/connections on properties.virtualNetworkGateway1.id and returns gateways with no connection resources - Review Azure Advisor Cost recommendations for '(Preview) Delete Azure virtual network gateways with no connections' - Before treating a VPN gateway as idle, check point-to-site use: P2S clients do not create connection resources, so review the P2S Connection Count (P2SConnectionCount) and Gateway P2S Bandwidth (P2SBandwidth) metrics over at least 30 days - For gateways that do have connections, check Tunnel Bandwidth (TunnelAverageBandwidth) and Gateway S2S Bandwidth (AverageBandwidth), or ExpressRouteGatewayBitsPerSecond for ExpressRoute gateways, to find connections that carry no traffic - Cross-check with network owners and change records for decommissioned sites, completed migrations and deleted ExpressRoute circuits ## How to fix 4 ways to remove the waste. - Confirm with the network owner that no site, circuit or remote user depends on the gateway, then delete the gateway and any stale connection and local network gateway resources - Delete or release the public IP addresses that were attached to the deleted gateway, since they continue to bill on their own - Record the gateway configuration (SKU, BGP settings, address spaces, connection settings) before deletion so it can be recreated if a site needs connectivity again - For gateways that must stay but carry light traffic, review whether a smaller SKU meets the tunnel, throughput and feature requirements ## Documentation Vendor references for pricing and configuration. - [FinOps best practices for Networking learn.microsoft.com](https://learn.microsoft.com/en-us/cloud-computing/finops/best-practices/networking) - [VPN Gateway Pricing azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/) - [Plan to manage costs for Azure ExpressRoute learn.microsoft.com](https://learn.microsoft.com/en-us/azure/expressroute/plan-manage-cost) - [Cost recommendations - Azure Advisor learn.microsoft.com](https://learn.microsoft.com/en-us/azure/advisor/advisor-reference-cost-recommendations) - [Supported metrics - microsoft.network/virtualnetworkgateways learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/microsoft-network-virtualnetworkgateways-metrics) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure NAT Gateway CER-0319 ### [Idle Azure NAT Gateway Attached to Subnet Without Active Workloads](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-azure-nat-gateway-attached-to-subnet-without-active-workloads) Azure NAT Gateways are commonly deployed to provide outbound internet connectivity for resources within virtual network subnets. Over time, the workloads that originally required this outbound access may be scaled down, migrated, or... Networking - Azure Private Link CER-0318 ### [Orphaned Private Endpoints After Target Service Deletion](https://www.pointfive.co/efficiency-hub/inefficiencies/orphaned-private-endpoints-after-target-service-deletion) Azure Private Endpoints are network interfaces that provide private connectivity from a virtual network to Azure PaaS services such as Storage Accounts, SQL Databases, or Key Vaults. When the target service behind a private endpoint is... Networking - Azure Bastion CER-0312 ### [Idle or Underutilized Azure Bastion Deployment](https://www.pointfive.co/efficiency-hub/inefficiencies/idle-or-underutilized-azure-bastion-deployment) Azure Bastion incurs continuous hourly charges from the moment it is deployed until the resource is deleted - regardless of whether any connections are actively being made. This means a Bastion host sitting idle in a development or test... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.