Cost control · Orphan Cleanup

Find and delete orphaned Azure resources that still bill every month

Q: Where do I get support?

support@llmgraph.ai, or the support page on katabarwalabs.dev.

Unattached disks, orphaned NICs, unassociated public IPs, and empty App Service plans, found daily with an estimated monthly saving on each.

Deploy from the Azure Marketplace Read the background

Deploys as a managed application in your own subscription. No vendor backend, no data egress. Flat monthly fee, billed by Microsoft.

The gap

A VM gets deleted and its disk, NIC, and public IP stay behind, billing quietly. Multiply by every decommission and every failed deployment and the leak is real. There is no native report and no native cleanup.

What it does

Daily inventory of unattached managed disks, orphaned NICs, unassociated Standard public IPs, and empty App Service plans.
Per-item and total estimated monthly cost on the report.
Resources tagged orphan-cleanup-exempt=true are never touched.
Report-only and dry run by default; deletion needs both an explicit setting and the Contributor role.
Posted to Teams as an Adaptive Card each morning.

The daily report: each orphan with its type, resource group, and estimated monthly cost.

The totals: what the subscription is paying for nothing.

Cleanup mode, once enabled, records exactly what it removed.

Honest about its limits

Savings figures are estimates from list prices and the report says so.
It looks for four resource types with clear orphan semantics; it does not judge whether a running resource is still needed.
The one write path, honestly scoped: Deleting orphaned resources, only after you enable cleanup, turn dry run off, and grant Contributor; exempt-tagged resources are never touched.

How it runs, and what it needs

A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so nothing runs until you say so. Every role it asks for, and why:

Reader	inventory disks, NICs, public IPs, and App Service plans
Contributor (only if you enable deletion)	remove confirmed orphans

Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.

FAQ

Does any data leave my subscription?

No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.

How is it billed?

A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.

How do I remove it?

Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.

Where do I get support?

support@llmgraph.ai, or the support page.

Deploy Orphan Cleanup in your subscription.

Unattached disks, orphaned NICs, unassociated public IPs, and empty App Service plans, found daily with an estimated monthly saving on each.

Deploy from the Azure Marketplace