Most Azure waste is not a bad architecture decision. It is a meter that kept running after its reason ended: a disk left behind by a deleted VM, a public IP nobody released, an empty App Service plan, a reservation nobody watches. This list covers seven common leaks, with how to find each one, how to fix it, and whether policy can stop it coming back, checked against Microsoft's documentation in September 2026.
Azure budgets alert, they do not stop spending, and every cost alert in Azure works on data that is hours or days old. This guide separates preventive guardrails (Azure Policy, quotas, subscription vending) from detective ones (budgets, anomaly alerts, Advisor), shows the latency gap between them, and proposes a baseline that puts each control at the right scope. Checked against Microsoft's documentation in September 2026.
Landing zone security is mostly decided before the first workload arrives. The guardrails, identity boundaries, and logging defaults that matter — and the ones that just add friction.