Setting Budgets and Cost Alerts in Azure

How Azure Budgets Work

An Azure budget is a spending threshold applied to a specific scope. When actual or forecast spend crosses a percentage of that threshold, Azure fires an alert. Budgets reset monthly, quarterly, or annually depending on how you configure them.

There are two alert types within a budget:

• Actual cost alerts: fire when cumulative spend in the period crosses a threshold percentage (e.g., 80% of budget). These are retrospective — money has already been spent.
• Forecasted cost alerts: fire when Azure’s spend projection indicates you will cross a threshold by the end of the period. These give you warning days before you actually overspend.

Creating a Budget in the Azure Portal

1. In the Azure portal, search for Cost Management + Billing and open it.

2. In the left menu, select Cost Management then Budgets.

3. Verify the scope shown at the top is correct (subscription, resource group, or management group). Click Change scope if needed.

4. Click + Add.

5. Fill in the budget details:

   • Name: give it a descriptive name like prod-monthly-budget
   • Reset period: Monthly, Quarterly, Annually, or Billing month
   • Creation date and expiration date: set an end date at least 12 months out
   • Amount: the total budget for the period in your billing currency

6. Click Next: Alerts.

7. Add alert conditions. You can add up to five thresholds per budget. A typical configuration:

   • 50% actual — information only
   • 80% actual — notify finance team
   • 90% forecasted — notify team leads
   • 100% actual — escalate to manager

8. For each threshold, specify an action group (for automated responses) or enter email addresses directly.

9. Click Create.

Creating Budgets with the Azure CLI

CLI-based budget creation is useful for automation, infrastructure-as-code pipelines, and managing budgets across multiple subscriptions programmatically.

# Get your subscription ID
SUBSCRIPTION_ID=$(az account show --query id -o tsv)

# Create a monthly budget of $500 on a subscription
az consumption budget create \
  --budget-name "prod-monthly-500" \
  --amount 500 \
  --time-grain Monthly \
  --start-date "2026-04-01" \
  --end-date "2027-04-01" \
  --resource-group-filter "" \
  --category Cost

# Note: Portal creation is recommended for adding alert thresholds and action groups
# as the CLI budget create command has limited support for alert conditions.
# Use the REST API or Bicep for full alert configuration.

Creating a budget with Bicep

resource monthlyBudget 'Microsoft.Consumption/budgets@2023-05-01' = {
  name: 'prod-monthly-budget'
  properties: {
    timePeriod: {
      startDate: '2026-04-01'
      endDate: '2027-04-01'
    }
    timeGrain: 'Monthly'
    amount: 500
    category: 'Cost'
    notifications: {
      actualSpend80: {
        enabled: true
        operator: 'GreaterThanOrEqualTo'
        threshold: 80
        thresholdType: 'Actual'
        contactEmails: [
          'finance@yourcompany.com'
          'teamlead@yourcompany.com'
        ]
      }
      forecastedSpend90: {
        enabled: true
        operator: 'GreaterThanOrEqualTo'
        threshold: 90
        thresholdType: 'Forecasted'
        contactEmails: [
          'teamlead@yourcompany.com'
        ]
      }
      actualSpend100: {
        enabled: true
        operator: 'GreaterThanOrEqualTo'
        threshold: 100
        thresholdType: 'Actual'
        contactEmails: [
          'manager@yourcompany.com'
          'finance@yourcompany.com'
        ]
      }
    }
  }
}

Automated Responses with Action Groups

Action groups let you wire budget alert notifications to automated actions. When a threshold is crossed, the action group can:

• Send email notifications to one or more addresses
• Send an SMS message
• Post to a webhook (useful for Slack or Teams notifications)
• Trigger an Azure Automation runbook (to stop VMs or scale down resources)
• Trigger an Azure Logic App workflow
• Call an Azure Function

Example: auto-stop dev VMs at 100% of budget

# First, create an Automation account and runbook that stops VMs
# Then create an action group that triggers the runbook

# Create the action group
az monitor action-group create \
  --resource-group cost-management-rg \
  --name "stop-dev-vms" \
  --short-name "StopDevVMs" \
  --action email finance finance@yourcompany.com

# The Automation runbook triggered by the action group:
# (PowerShell runbook in Azure Automation)
# param([object]$WebhookData)
# $vms = Get-AzVM -ResourceGroupName "dev-rg"
# foreach ($vm in $vms) {
#     Stop-AzVM -ResourceGroupName $vm.ResourceGroupName -Name $vm.Name -Force
# }

Cost Anomaly Alerts

Beyond budget thresholds, Azure Cost Management includes anomaly detection that identifies unusual spending patterns using machine learning. Unlike budget alerts which fire when cumulative spend crosses a level, anomaly alerts fire when a day’s spending is significantly higher than expected based on your historical patterns.

Anomaly alerts can detect:

• A forgotten VM that was left running after a test
• An accidental deployment of expensive GPU VMs
• Runaway storage costs from a misconfigured logging pipeline
• Unusual data egress from a potential security incident

# Cost anomaly alerts are configured in the portal under
# Cost Management > Anomaly alerts
# There is no direct CLI command; use the REST API:

az rest \
  --method PUT \
  --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.CostManagement/scheduledActions/daily-anomaly-alert?api-version=2023-11-01" \
  --body '{
    "kind": "InsightAlert",
    "properties": {
      "displayName": "Daily cost anomaly alert",
      "status": "Enabled",
      "notification": {
        "to": ["finance@yourcompany.com"],
        "subject": "Azure Cost Anomaly Detected"
      },
      "schedule": {
        "frequency": "Daily",
        "dayOfWeek": "Monday"
      }
    }
  }'

Budget Strategy Across Environments

In most organisations, you will want separate budgets for production, staging, and development environments. A practical approach is to use resource group-scoped budgets rather than subscription-level budgets, which gives you finer visibility: