Stop surprise Azure bills with budgets and anomaly alerts

Budgets

A budget tracks spending against an amount over a period and sends alerts when you cross thresholds. Create one in Cost Management → Budgets at subscription or resource group scope.

• Set thresholds on actual cost (such as 50%, 80% and 100%) and on forecasted cost (such as 100%). Forecast alerts warn you before the money is spent.
• Send alerts to a shared mailbox or an action group, not one person.
• Budgets alert; they don't stop anything. Use an action group to trigger automation if you need it, for example shutting down dev VMs.

az consumption budget create \
  --budget-name monthly-dev \
  --amount 500 \
  --category cost \
  --time-grain monthly \
  --start-date 2026-09-01 \
  --end-date 2027-08-31

Picking the thresholds

The forecast alert is the most useful one. It arrives while there's still time to do something, rather than confirming the overspend after the fact.

Scope and filters

You can set budgets at management group, subscription or resource group scope, and filter them by tags, resource types or services. A filter on env = dev or a single expensive service gives a sharper alert than one big subscription number.

Anomaly alerts

Cost Management can detect unusual spending patterns in a subscription automatically. Turn on anomaly alerts under Cost alerts to get an email when spending jumps beyond the normal pattern, even if you're well under budget. A runaway log ingestion or a forgotten large VM shows up as an anomaly within a day or so, not at the end of the month.

Anomaly detection learns what normal looks like for a subscription, so a new subscription needs some history before it's useful. It's a good partner to budgets because the two fail in different ways: a budget that's set too high never fires, and anomaly detection doesn't care what the budget says.

Make costs visible

• Tag everything with an owner and a cost centre. Azure Policy can enforce and inherit tags.
• Schedule a cost report by email to each team, grouped by their tag.
• Review Advisor cost recommendations monthly for idle resources and right-sizing.

Automating a response

An action group can call a webhook, an Automation runbook, a Logic App or a Function. A common pattern for dev and test subscriptions:

1. Budget threshold at 100% of actual cost calls an action group.
2. The action group starts an Automation runbook with a managed identity.
3. The runbook deallocates VMs tagged autoshutdown = true and posts a message to the team.

Keep automation to non-production. Stopping production workloads because of a cost alert is rarely the right trade.

Five-minute checklist

• A budget on every subscription, with a forecast alert at 100%
• Alerts go to a shared mailbox or action group, not one person
• Anomaly alerts switched on for each subscription
• Owner and cost-centre tags enforced by Azure Policy
• A monthly scheduled cost view emailed to each team
• Advisor cost recommendations reviewed once a month