Ten read-only PowerShell scripts that find wasted Azure spend and security misconfigurations, and price the waste the way Azure actually bills it.The cost figures are the pointMost cleanup scripts multiply disk size by a flat per-GB rate. Azure does not bill that way. Managed disks bill by provisioned tier, so a 128 GB Premium SSD is one P10 whatever it contains, and a 100 GB disk costs exactly the same as that 128 GB one.Prices come from the public Azure Retail Prices API, per resource region, in your billing currency. Basic SKU load balancers are costed at zero because they are free. Premium SSD v2 and Ultra disks are reported without an estimate rather than guessed at, because they bill IOPS and throughput separately.If a number is wrong, you argue with the wrong people. That is why this exists.What the ten scripts findCost- Unattached managed disks, unused NICs, unassociated public IPs, load balancers with nothing behind them- Running VMs sitting at near-zero average CPU- Disk snapshots nobody deleted- Month-to-date spend broken down by any tag keySecurity and governance- NSG rules open to the internet on sensitive ports, including rules written as port ranges- Storage accounts and containers with public blob access- Role assignments belonging to disabled or deleted users, and high-privilege guest accounts- Service principals with expired credentials or no role assignments- Key Vault secrets and certificates, and app registration credentials, nearing expiry- Resources missing your required governance tagsIt will not lie to youIf your session has expired, or a scope is unreadable, the script says so and exits non-zero. It will never report a clean estate because it failed to reach Azure. Where it cannot enumerate something, it tells you the scan was incomplete and names what it skipped.Nothing is deleted or modified. These scripts only read.ScopeEvery script scans the current subscription by default, a named set, or every subscription you can see: ./Test-NSGRules.ps1 ./Test-NSGRules.ps1 -SubscriptionId "Prod","Dev" ./Test-NSGRules.ps1 -AllSubscriptionsName a subscription that does not resolve and it stops, rather than quietly scanning a smaller set. Your original subscription context is always restored.Two editions, both includedSingle File Pack - every script completely self-contained. Paste one into an Azure Automation runbook or drop it on a jump box and it runs. No shared module, no folder layout to preserve.All-in-One Bundle - shared code in a module with thin scripts. About a third less code to read when you customise, and the helper functions are importable and testable on their own.Same parameters, same exit codes, same output. Use whichever suits the job.Practical details- Every script takes -ExportCsv and -Verbose- Exit codes for scheduled runs: 0 nothing found, 1 could not run, 2 findings to review- PowerShell 5.1 or 7+, and the Az modules- Reader covers most of it; the readme lists exactly which scripts need more and why- Full comment-based help on every script, so Get-Help ./Get-IdleVMs.ps1 -Full worksLifetime updates, no subscription. Azure prices move and the Az modules ship breaking changes; fixes are included for as long as the toolkit is published.LicenceUse it across your own organisation's Azure tenants, modify it freely, commercial use included. Full terms in the download.For running it against client tenants during paid work, handing clients the reports, or leaving a copy in their environment, you want the Consultant tier. To embed it in a product or service you sell, the Redistribution tier.Not sure which you need? info@acloud.solutions