azure-resource-sweeper

An Azure CLI extension that detects and safely cleans up stale and unused resources — unattached disks, dangling NICs, unused public IPs and empty App Service plans that quietly keep costing money.

Why?

Stale resources are easy to create and easy to forget. They never show up on a dashboard you look at, but they always show up on the bill. azure-resource-sweeper uses Azure Resource Graph KQL queries to find them in seconds and removes them with a dry-run-first safety model.

Installation

As an Azure CLI extension (recommended)

# Install directly from PyPI
az extension add --name azure-resource-sweeper

# Or from a local wheel (for development)
pip install build
python -m build
az extension add --source dist/azure_resource_sweeper-*-py3-none-any.whl

For local development with azdev

pip install azdev
azdev setup --repo .
azdev extension add resource-sweeper
az sweeper --help

Quick start

# 1. Scan the entire subscription for every stale resource type
az sweeper scan

# 2. Scan for unattached disks and show estimated monthly cost
az sweeper scan --type disk --estimate-cost

# 3. Scan a single resource group and output JSON
az sweeper scan -g my-rg --output json

# 4. Preview what would be deleted (dry-run — nothing is removed)
az sweeper clean --type publicip

# 5. Delete all stale resources without a prompt
az sweeper clean --type all --dry-run false --yes

Supported resource types

Command reference

az sweeper scan

az sweeper clean

Authentication

Authentication uses DefaultAzureCredential — once you have run az login the extension just works. In CI, set the standard Azure SDK environment variables (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET) or use a managed identity — no extra configuration needed.

Extension architecture

This project follows the official Azure CLI extension format:

Contributing

Contributions are very welcome! See CONTRIBUTING.md for how to set up a local dev environment, run tests, and add a new resource type.

License

Apache 2.0 © Dana Kim