You dont have javascript enabled! Please enable it!

Automate Stop and Start of Azure Application Gateway

6 Min. Read

In this article, I will show you how to automate the stop and start of Azure Application Gateway with the new Az PowerShell module, so you can schedule it to run based on your needs and save money.


Azure Application Gateway manages the requests that client applications can send to a web app. Application Gateway routes traffic to a pool of web servers based on the URL of a request. This is known as application-layer routing. The pool of web servers can be Azure virtual machines, Azure virtual machine scale sets, Azure App Service, and even on-premises servers.

Automate Stop and Start of Azure Application Gateway 1

The web application firewall (WAF) is an optional component of the Application Gateway that handles incoming requests before they reach a listener. The web application firewall checks each request for many common threats, based on the Open Web Application Security Project (OWASP). These include SQL-injection, Cross-site scripting, Command injection, HTTP request smuggling, HTTP response splitting, Remote file inclusion, Bots, crawlers, and scanners, and HTTP protocol violations and anomalies. WAF is enabled on your Application Gateway by selecting the WAF tier when you create a gateway.

Microsoft charges the application gateways based on the amount of time (per hour) that the gateway is provisioned and available, as well as the amount of data processed by the application gateways. Additionally, the v2 SKU of Application Gateway pricing model is driven by consumption and is no longer attached to instance counts or sizes. The v2 SKU pricing has two components (Fixed price per hour or partial hour, and Capacity Unit price which is also consumption-based cost that is charged in addition to the fixed cost). As you can see, the price could go up very quickly.

For detailed information regarding the price of Application Gateway v2 for Standard and Web Application Firewall, please see the official pricing page here.

What about if you have an application that does not require to be available 24h/7d, or you want to test your web application with Application Gateway before you put it in production, and you are limited on budget. Can you save costs?

The answer is YES!


To follow this article, you need to have the following:

1) Azure subscription – If you don’t have an Azure subscription, you can create a free one here.

2) Static public IP address with Standard SKU – you can create a new public IP by running the following Azure CLI command: az network public-ip create -n pip-agw-v2 -g resourceGroupName –allocation-method Static –sku Standard

3) Application Gateway v2 up and running (Standard or WAF) – If you don’t have an Application Gateway, you can follow the step-by-step guide and create one here.

Create an Azure Automation Account

First, I need to create an Azure automation resource with Run As Account. Run As accounts in Azure Automation are used to provide authentication for managing resources in Azure with the Azure cmdlets. When you create a Run As Account, it creates a new service principal user in Azure Active Directory and assigns the Contributor role to this user at the subscription level. So it would make sense to look into changing RBAC settings for the subscription or resource groups if you want to limit that. Also, all users that have access to the Automation Account will also have the opportunity to use this Azure Run As Account.

Open the Azure portal, click All services found in the upper left-hand corner. In the list of resources, type Automation. As you begin typing, the list filters based on your input. Select Automation Accounts. Click +Add

Automate Stop and Start of Azure Application Gateway 2

Select the desired Subscription, Resource group, and Location for the automation account, and then click ‘Create‘.

Import Az Modules from Gallery

In the next step, you need to import the required Az PowerShell modules from the Modules gallery.

In your list of Automation Accounts, select the account that you created in the previous step. Select the Modules gallery under the Shared Resources section.

Then you need to import the following modules from the Modules gallery in the order given below:

  1. Az.Accounts
  2. Az.Network
  3. Az.Automation

Automate Stop and Start of Azure Application Gateway 3

The Az Automation and Az Network modules are dependent on Az Accounts, so make sure that the Az Accounts module is imported first.

Create PowerShell Runbooks

In this step, you can create multiple Runbooks based on which set of Azure Application Gateways you want to automate. PowerShell Runbooks are based on PowerShell. You directly edit the code of the Runbook using the text editor in the Azure portal. You can also use any offline text editor and import the Runbook into Azure Automation.

In this example, I will create two Runbooks as PowerShell type, the first Runbook is to ‘Stop‘ and the second one is to ‘Start‘ the Application Gateway for a specific Subscription / Resource Group.

Automate Stop and Start of Azure Application Gateway 4

You can create as many Runbooks as you want based on your scenario.

Edit The Runbook

Once you have the Runbook created, you need to Edit the Runbook, then write or add the script to choose which Azure Application Gateway you want to manage. Of course, you can be creative and automate other components as well.

As I mentioned earlier, in this example, I want to stop my application gateway at night and then start it in the morning until the development of my web application is completed. The script as follows:

A Runbook example which stop Azure Application Gateway in a specific Azure subscription
Using the Run As Account (Service Principal in Azure AD).

Filename : Stop-AzApplicationGateway
Author   : Charbel Nemnom
Version  : 1.0
Date     : 27-August-2020
Updated  : 23-July-2021

To provide feedback or for further assistance please visit:

Param (
    [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()]
    [String] $AzureSubscriptionId,

    [Parameter(Mandatory = $true)][ValidateNotNullOrEmpty()]
    [String] $rgName,

    [Parameter(Mandatory = $true)][ValidateNotNullOrEmpty()]
    [String] $ApplicationGateway

$connectionName = "AzureRunAsConnection"

Try {
    #! Get the connection "AzureRunAsConnection "
    $servicePrincipalConnection = Get-AzAutomationConnection -Name $connectionName
    Write-Output "Logging in to Azure..."
    Connect-AzAccount -ServicePrincipal `
         -TenantId $servicePrincipalConnection.TenantId `
         -ApplicationId $servicePrincipalConnection.ApplicationId `
         -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
Catch {
    If (!$servicePrincipalConnection) {
        $ErrorMessage = "Connection $connectionName not found..."
        throw $ErrorMessage
    Else {
        Write-Error -Message $_.Exception
        throw $_.Exception

Set-AzContext -SubscriptionId $AzureSubscriptionId

$agw = Get-AzApplicationGateway -name $ApplicationGateway -ResourceGroupName $rgName
Stop-AzApplicationGateway -ApplicationGateway $agw

Write-Output ("")

This script will stop the Application Gateway (Stop-AzApplicationGateway). The second Runbook is exactly the same except that it will start the Application Gateway (Start-AzApplicationGateway).

Save the script in the CMDLETS pane as shown in the figure below.

Automate Stop and Start of Azure Application Gateway 5

Then test the script using “Test Pane” to verify it’s working as intended before you publish it.

Automate Stop and Start of Azure Application Gateway 6

Once the test is completed, publish the Runbook by clicking on ‘Publish‘.

Now you want to repeat the same steps as described here to create the second Runbook to ‘Start‘ the application gateway.

Schedule the Runbook

In the final step, you need to schedule the Runbook to run based on your desired runtime schedule.

Within the same Runbook that you create in the previous step, select Schedules and then click + Add schedule.

Automate Stop and Start of Azure Application Gateway 7

So, if you need to schedule a daily stop, then you create a new schedule based that looks similar to below:

Automate Stop and Start of Azure Application Gateway 8

While scheduling the Runbook, you can pass on the required parameters for the PowerShell script. In my example, I need to specify the Azure Subscription ID, Resource Group Name, and Application Gateway Name. Once done, click OK.

Automate Stop and Start of Azure Application Gateway 9

Now you want to repeat the same steps as described here to schedule the second Runbook to ‘Start‘ the application gateway based on your desired schedule. My schedules look like this:

Automate Stop and Start of Azure Application Gateway 10

Monitor the Runbook

You can monitor the success or failure of these Runbooks using the ‘Jobs‘ tab under ‘Process Automation‘. In my example, the ‘Stop‘ Runbook completed successfully on August 27, 2020, @ 8:00 PM, and the ‘Start‘ Runbook completed on August 28, 2020, @ 7:00 AM.

Automate Stop and Start of Azure Application Gateway 11

That’s it there you have it!

Can I use Azure CLI?

Yes, you can use Azure CLI to stop and start the Application Gateway.

For example, you can either install the latest Azure CLI version 2.10.1 on your machine, or jump over the Cloud Shell (, or use the Azure Cloud Shell Connector in Windows Terminal.

Login to Azure and set the desired subscription by running the following commands:

#! Login to Azure
az login
az account set --subscription "Subscription-ID-Here"
$rgname = "ResourceGroupName"
$appgw = "AppGatewayName"
#! Show current status
az network application-gateway show -g $rgname -n $appgw -o table
#! Stop Application Gateway with Azure CLI
az network application-gateway stop -g $rgname -n $appgw
#! Start Application Gateway with Azure CLI
az network application-gateway start -g $rgname -n $appgw

Automate Stop and Start of Azure Application Gateway 12

As a side note, running Runbooks with Azure CLI is not supported yet in Azure Automation, please add your vote here.


In this article, I showed you how to schedule and automate the stop and start of the Azure Application Gateway using PowerShell and Azure CLI so you can schedule it based on your needs and save costs.

Azure Application Gateway provides an application delivery controller (ADC) as a service. It offers various layer 7 load-balancing capabilities for your applications. This service is highly available, scalable, and fully managed by Azure. To learn more about Application Gateway, see What is Azure Application Gateway?

Thank you for reading my blog.

If you have any questions or feedback, please leave a comment.

-Charbel Nemnom-

Photo of author
About the Author
Charbel Nemnom
Charbel Nemnom is a Senior Cloud Architect, Swiss Certified ICT Security Expert, Certified Cloud Security Professional (CCSP), Certified Information Security Manager (CISM), Microsoft Most Valuable Professional (MVP), and Microsoft Certified Trainer (MCT). He has over 20 years of broad IT experience serving on and guiding technical teams to optimize the performance of mission-critical enterprise systems with extensive practical knowledge of complex systems build, network design, business continuity, and cloud security.

Related Posts


How to Lower Azure File Shares Cost with Hot and Cool Tiers

Azure Defender for Container Registries in Azure Security Center


4 thoughts on “Automate Stop and Start of Azure Application Gateway”

Leave a comment...

  1. Thank you for the article, and also for the article with the app gateway in front of the Azure storage account. About costs… when requests come in via the App Gateway to download this giant MP4 from the storage account… does that MP4 data go through the Application Gateway, in other words, does that add to the cost of the App Gateway?

  2. Hello Pablo, thanks for the feedback! Good question.
    Yes, the data go through the Application Gateway (known as Data processing). The Data processing charge is based on the amount of data processed by the application gateways.
    The cost will be calculated based on the SKU you have for the App Gateway (Small, Medium, or large). The Small SKU is ($0.008 per GB), and if you have Medium SKU (the First 10 TB/month is free, and then $0.007 per GB), and if you have a large SKU (the First 40 TB/month is free, and then $0.0035 per GB). You can check the price for data processing on this page.
    Hope this helps!

Let me know what you think, or ask a question...

error: Alert: The content of this website is copyrighted from being plagiarized! You can copy from the 'Code Blocks' in 'Black' by selecting the Code. Thank You!