Azure Cost Management — Budget Alerts & Anomalies
Proactive Cost Control
Introduction
Azure Cost Management provides tools to monitor, allocate, and optimize cloud spending. For integration workloads that can scale dynamically, setting up proper budget alerts and anomaly detection is critical. Without these controls, a runaway function or misconfigured integration can quickly generate unexpected costs. This guide covers implementing robust cost controls for Azure integration environments.
This comprehensive guide covers:
- Budget configuration — Setting spending limits
- Alert workflows — Notification and response
- Anomaly detection — Finding unexpected spending
- Cost allocation — Chargeback and showback
- Automation — Cost optimization triggers
Budget Configuration
Budget Setup
# Create budget at resource group level
az consumption budget create \
--budget-name "integration-monthly" \
--amount 2000 \
--time-grain Monthly \
--start-date 2024-01-01 \
--resource-group rg-integration \
--notifications \
"[{
\"enabled\": true,
\"operator\": \"GreaterThan\",
\"threshold\": 80,
\"contactEmails\": [\"finops@company.com\", \"platform-lead@company.com\"]
},
{
\"enabled\": true,
\"operator\": \"GreaterThan\",
\"threshold\": 100,
\"contactEmails\": [\"ciso@company.com\"],
\"notifyRecipients\": [\"slack:#cloud-cost\"]
}]"
# Create budget at subscription level
az consumption budget create \
--budget-name "azure-monthly" \
--amount 10000 \
--time-grain Monthly \
--start-date 2024-01-01 \
--subscription /subscriptions/xxx \
--notifications \
"[{
\"enabled\": true,
\"operator\": \"GreaterThan\",
\"threshold\": 50,
\"contactEmails\": [\"finops@company.com\"],
\"thresholdType\": \"Forecasted\"
}]"
Budget Configuration
{
"budgetConfig": {
"monthlyBudget": 5000,
"thresholds": {
"warning": 50,
"critical": 75,
"exceeded": 100
},
"filters": {
"resourceGroups": ["rg-integration"],
"meters": ["Function App", "Service Bus", "API Management"]
},
"notifications": {
"email": ["platform-team@company.com", "finops@company.com"],
"slack": "#azure-cost-alerts",
"webhook": "https://company.com/api/cost-alerts"
},
"forecastEnabled": true,
"budgetType": "ActualCost"
}
}
Alert Management
Alert Workflow
┌─────────────────────────────────────────────────────────────────────┐
│ COST ALERT WORKFLOW │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ LEVEL 1: WARNING (50%) │
│ ───────────────────────────── │
│ • Email to platform team │
│ • Post to Slack channel │
│ • Action: Review spending trends │
│ ───────────────────────────────────── │
│ │
│ LEVEL 2: CRITICAL (75%) │
│ ───────────────────────────── │
│ • Email to platform lead + FinOps │
│ • Escalate to Slack │
│ • Action: Investigate immediate │
│ ───────────────────────────────────── │
│ │
│ LEVEL 3: EXCEEDED (100%) │
│ ───────────────────────────── │
│ • Email to leadership │
│ • Page on-call if after hours │
│ • Action: Implement emergency measures │
│ • Consider: Stop non-critical resources │
│ │
└─────────────────────────────────────────────────────────────────────┘
Azure Monitor Alert Configuration
# Create cost alert with Azure Monitor
az monitor scheduled-query create \
--name "cost-anomaly" \
--resource-group rg-monitoring \
--location eastus \
--description "Alert on cost anomalies" \
--display-name "Cost Anomaly Detection" \
--metric-name "Cost" \
--operator "GreaterThan" \
--threshold 500 \
--time-aggregation "Daily" \
--window-size "P1D" \
--evaluation-frequency "PT1H"
Anomaly Detection
Built-in Anomaly Detection
{
"anomalyDetection": {
"enabled": true,
"sensitivity": "Medium",
"alertScope": {
"resourceGroups": ["rg-integration", "rg-production"]
},
"notification": {
"email": ["finops@company.com"],
"slack": true
}
}
}
Custom Anomaly Detection
public class CostAnomalyDetector
{
public async Task<List<Anomaly>> DetectAnomaliesAsync(
TimeRange period)
{
var dailyCosts = await GetDailyCostsAsync(period);
var anomalies = new List<Anomaly>();
// Calculate baseline (average excluding outliers)
var baseline = CalculateBaseline(dailyCosts);
var stdDev = CalculateStdDev(dailyCosts, baseline);
foreach (var day in dailyCosts)
{
var deviation = (day.Cost - baseline) / stdDev;
if (deviation > 2.5) // 2.5 standard deviations
{
anomalies.Add(new Anomaly
{
Date = day.Date,
ExpectedCost = baseline,
ActualCost = day.Cost,
Deviation = deviation,
TopCostDrivers = await GetCostDriversAsync(day),
Recommendation = GenerateRecommendation(day)
});
}
}
return anomalies;
}
private async Task<List<CostDriver>> GetCostDriversAsync(CostDay day)
{
// Identify which services/resources caused the spike
var details = await GetCostDetailsAsync(day);
return details
.OrderByDescending(d => d.Cost)
.Take(5)
.ToList();
}
}
Cost Allocation
Tag-Based Allocation
# Common tags for integration workloads
# business-unit: Sales, Marketing, Engineering
# cost-center: 12345
# environment: prod, staging, dev
# project: migration, new-feature
# owner: team-email
# Query costs by tag
az costmanagement query \
--type ActualCost \
-- timeframe LastMonth \
--dataset-grouping "Tag:environment" \
--filter "Tag:environment IN ['prod', 'staging']"
Showback Report
{
"showbackReport": {
"month": "2024-01",
"period": "2024-01-01 to 2024-01-31",
"allocation": [
{
"businessUnit": "Sales",
"cost": 4500,
"percentage": "35%",
"services": [
{"name": "Order Processing", "cost": 2800},
{"name": "Customer Sync", "cost": 1700}
]
},
{
"businessUnit": "Marketing",
"cost": 3200,
"percentage": "25%",
"services": [
{"name": "Campaign Integration", "cost": 2200},
{"name": "Analytics Pipeline", "cost": 1000}
]
}
]
}
}
Automation and Optimization
Cost-Based Automation
# Azure Logic App: Cost Alert Handler
name: CostAlertHandler
trigger:
- type: "When an alert is triggered"
condition: "Alert name contains 'budget'"
actions:
- Parse alert details
- Identify affected resource group
- Check current spend rate
- condition: "Alert threshold > 90%"
actions:
- Send urgent notification
- Disable non-critical resources
- Enable cost cap if available
- condition: "Alert threshold > 75%"
actions:
- Send warning notification
- Analyze cost drivers
- Propose optimization actions
Scheduled Cost Review
{
"costReviewSchedule": {
"daily": {
"review": "Spend rate vs budget",
"owner": "Platform team"
},
"weekly": {
"review": "Cost trends and anomalies",
"owner": "FinOps + Platform"
},
"monthly": {
"review": "Full cost analysis, showback",
"owner": "Finance + Leadership"
},
"quarterly": {
"review": "Budget planning, reservation review",
"owner": "Finance"
}
}
}
Best Practices
Implementation Checklist
| Practice | Description |
|---|---|
| Set budgets early | Create before resources deployed |
| Use multiple scopes | Subscription + resource group levels |
| Enable forecasts | Early warning before budget hit |
| Anomaly detection | Find unexpected spending |
| Tag everything | Enable cost allocation |
| Automate response | Handle alerts automatically |
Key Metrics
┌─────────────────────────────────────────────────────────────────────┐
│ COST METRICS TO TRACK │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ OPERATIONAL: │
│ ✓ Daily spend rate │
│ ✓ Month-to-date vs forecast │
│ ✓ Resource group costs │
│ ✓ Service-level costs │
│ │
│ EFFICIENCY: │
│ ✓ Cost per transaction/message │
│ ✓ Cost per API call │
│ ✓ Unit economics │
│ │
│ TREND: │
│ ✓ Month-over-month change │
│ ✓ Year-over-year change │
│ ✓ Seasonal patterns │
│ │
└─────────────────────────────────────────────────────────────────────┘
Related Topics
- FinOps Framework — Cost culture
- Right-Sizing — Resource optimization
- Reserved Instances — Commitment savings
Azure Integration Hub - Architect Level Cost Architecture & FinOps