Episode 11 — Controlling Spend — Cost Management, Budgets, Alerts, and Advisor

In Episode 10 you put guardrails on the estate: Azure Policy to constrain what state resources may have, and resource locks to freeze what must not change. One guardrail remains — the financial one. This final episode covers how Azure charges flow, how budgets and alerts keep spending visible, and how Azure Advisor turns telemetry into optimization advice.

Learning objectives

• Describe how Microsoft Cost Management supports the FinOps loop: analyze, organize, monitor, optimize.
• Configure a budget with actual and forecasted cost alerts, and state its scope, permission, and timing constraints.
• Distinguish the main cost alert types (budget, credit, department spending quota, anomaly) and match each to the agreement type that supports it.
• Use Azure Advisor recommendations across its five categories and manage recommendation states.

Why it matters

Governance without cost control is incomplete: an administrator who can organize scopes, assign roles, and enforce policies is still expected to explain — and prevent — a surprise bill. The AZ-104 objective "Manage costs by using alerts, budgets, and Azure Advisor recommendations" tests exactly the facts in this episode: what a budget does (and, critically, what it does not do), which alert fires when, and which Advisor category a recommendation belongs to. In real administration, these are the tools you reach for on day one of any new subscription.

Cost Management: the FinOps toolset

Microsoft Cost Management is a suite of FinOps tools for analyzing, monitoring, and optimizing Microsoft Cloud costs. It is available to anyone with access to a billing account, subscription, resource group, or management group — so, unlike most tools in this module, even a Reader at a modest scope can see cost data. Cost Management (the FinOps tools) sits alongside Billing (the tools to manage the billing account and pay invoices); the two are related but distinct.

How charges flow

Every commercial transaction runs through the Microsoft Commerce data pipeline. Services meter usage and push it into the pipeline; the rating system applies the discounts from your price sheet and produces rated usage — a price and quantity per cost record. At the end of the month, credits are applied and the invoice is published starting 72 hours after the billing period ends. Everything up to invoice publication is the billing process; the rated cost data feeds Cost Analysis and can be pushed to storage via scheduled exports.

Two traps to remember:

• Credits are applied like a gift card before the invoice is generated — they are not visibly applied to charges until the end of the month.
• Cost Management data does not include credits, taxes, and some purchases (such as support charges on non-MCA accounts). What you see in Cost Analysis is not your invoice.

The four FinOps activities

On the organize side, tags are the most flexible mapping of resources to applications, business units, environments, and owners. Recall from Episode 9 that resources do not inherit tags from their resource group or subscription — but Cost Management's tag inheritance feature copies subscription and resource-group tags down to resources in cost data only; nothing is saved on the resources themselves. A companion feature, cost allocation, lets you move or split shared costs between subscriptions, resource groups, or tags — again for reporting only, the invoice is unchanged.

On the optimize side, before buying commitments, Azure Advisor is the first stop for existing resources (recommendations updated daily); the pricing calculator and Azure Migrate help estimate costs before deployment.

Budgets: plan, alert — but never stop

A budget helps you plan for and drive organizational accountability. The single most-tested fact: budgets do not stop consumption — when a threshold is exceeded, notifications fire, but resources are not affected. A budget is a smoke detector, not a circuit breaker. (If you need enforcement, that is Azure Policy territory — Episode 10.)

Scopes and permissions

Budgets are supported at Azure RBAC scopes — management group, subscription, resource group — and at billing scopes (EA billing account/department/enrollment account; MCA billing account/profile/invoice section/customer; individual-agreement billing account). Per subscription, permissions follow familiar RBAC logic:

Two environmental constraints: a new subscription can need up to 48 hours before Cost Management features work, and all subscriptions inside a scope (say, a management group) must operate under a single currency.

Timing, periods, and lifecycle

Cost data is typically fresh within 8–24 hours, budgets are evaluated against it every 24 hours, and when a threshold is met the email notification normally arrives within an hour. So the end-to-end lag from spend to inbox can approach a day — a budget alert is never real-time.

The reset period is Monthly, Quarterly, or Annually — or billing month/quarter/year to align with invoice periods. Evaluated cost starts at zero at the beginning of each period; a quarterly budget divides the amount evenly across three months, an annual one across twelve. Budgets reset automatically at period end and auto-delete when their expiration date passes.

Actual vs forecasted alerts

Each budget needs at least one cost threshold (% of budget) with an email address, and supports up to five thresholds and five email addresses. Thresholds range from 0.01% to 1000% of the budget. The Type field toggles each alert between two behaviors:

Budget evaluations include reserved-instance and purchase data and are based on actual cost, not amortization; to watch only first-party Azure consumption, filter on Publisher Type: Azure and Charge Type: Usage. Practical tip from the docs: whitelist azure-noreply@microsoft.com so alerts don't land in junk mail.

Automation: action groups

At subscription and resource-group scopes only, a budget can trigger an action group when a threshold is met — email, mobile push (the Azure mobile app shows budgets for those same two scopes), or automation such as Azure Functions or webhooks. This is how you graduate from "get notified" to "run a response," while remembering the budget itself still stops nothing.

Budgets can also be created programmatically:

Connect-AzAccount
Select-AzSubscription -Subscription "Your Subscription"
$email1 = New-AzActionGroupReceiver -EmailAddress test@test.com -Name EmailReceiver1
$ActionGroupId = (Set-AzActionGroup -ResourceGroupName YourResourceGroup -Name TestAG -ShortName TestAG -Receiver $email1).Id
New-AzConsumptionBudget -Amount 100 -Name TestPSBudget -Category Cost -StartDate 2020-02-01 -TimeGrain Monthly -EndDate 2022-12-31 -ContactEmail test@test.com -NotificationKey Key1 -NotificationThreshold 0.8 -NotificationEnabled -ContactGroup $ActionGroupId

Caveat: budgets created with PowerShell don't send notifications, and Microsoft Customer Agreement customers should use the Budgets REST API instead.

Cost alerts: the three main types (plus one)

The Cost alerts page (open a scope > Budgets > Cost alerts) gathers all cost and billing alerts in one place. There are three main types — plus anomaly alerts you can create separately:

Read the table vertically for the exam: credit and department quota alerts are Enterprise Agreement–only; budget alerts work everywhere. In the portal, budgets are defined by cost; through the Azure Consumption API they can also be defined by usage.

Each alert shows its type, generation date, status, and scope, and is either active (still relevant) or dismissed; you can reactivate a dismissed alert if it needs manual action. For alert permissions: Owner, Contributor, and Cost Management Contributor can read and update alerts; Reader and Cost Management Reader are read-only.

Azure Advisor: your optimization to-do list

Azure Advisor is a digital cloud assistant that analyzes your resource configuration and usage telemetry and produces proactive, actionable, personalized best-practice recommendations, with proposed actions inline. You reach it in the Azure portal (navigation pane, or All services), and you can read it with mere Reader rights — Owner, Contributor, or Reader of a subscription, resource group, or resource all qualify.

The dashboard groups recommendations into five categories:

🧠 Mnemonic: Advisor harvests CROPS — Cost, Reliability, Operational excellence, Performance, Security.

An active recommendation can be manually set to Postponed (hide, review later), Dismissed (not relevant), or Completed (action taken); after you actually implement one, Advisor's own verification can take up to a day to recognize it, and until then you can still change states or reactivate. Advisor covers a long list of services (VMs and scale sets, App Service, Application Gateway, Cosmos DB, Key Vault, AKS, SQL Server, storage accounts, ExpressRoute, Front Door, and more).

One cross-episode gotcha worth repeating from Episode 10: a ReadOnly lock on a subscription breaks Azure Advisor — the lock reduces everyone to reader-level control-plane access, and Advisor stops working at that scope. If Advisor mysteriously fails, check the locks.

Exercises

Exercise 11.1 — A production budget with early warning

On a trial subscription, design and create a monthly budget of 500 (in the subscription currency) that (a) emails FinOps at 80% of actual cost, (b) warns at 100% forecasted cost, and (c) triggers an action group for automation. List every platform constraint you touch along the way.

Exercise 11.2 — Match the alert to the scenario

For each scenario, name the cost alert type and whether any configuration is needed:

1. An EA customer's Azure Prepayment balance just hit 90%.
2. A subscription's daily usage suddenly triples with no deployment planned.
3. An EA department has consumed 75% of its assigned spending quota.
4. A Pay-As-You-Go subscription's spend reached the 80% line the admin defined.

Exercise 11.3 — Triage the Advisor inbox

Advisor shows three recommendations on your subscription: (a) "Right-size or shut down an underutilized virtual machine," (b) "Buy a reservation for consistent VM usage," (c) "Enable backup on your virtual machines." Assign each a category, state the permission needed just to read them, and describe your next action for one you cannot act on this sprint.

Key takeaways

• Cost Management = FinOps tools (analyze, organize, monitor, optimize); Billing manages the account and invoices; the invoice publishes 72 hours after the billing period ends, and Cost Management data excludes credits and taxes.
• Tag inheritance and cost allocation reshape cost data only — never the resources, never the invoice.
• Budgets alert, they never stop consumption; data is fresh in 8–24 h, evaluated every 24 h, emails within ~1 h.
• A budget supports actual and forecasted alerts, up to 5 thresholds + 5 emails (0.01–1000%), and action groups at subscription/RG scopes only; PowerShell-created budgets send no notifications.
• Cost alert types: budget (all agreements), credit (EA Azure Prepayment, auto at 90%/100%), department spending quota (EA), anomaly (subscriptions only).
• Azure Advisor gives personalized recommendations in five categories (CROPS), readable by Owner/Contributor/Reader, with states Active/Postponed/Dismissed/Completed and up to a day for verification.
• Optimization levers: savings plans up to 65%, reservations up to 72%, Azure Hybrid Benefit.
• A ReadOnly lock on a subscription breaks Advisor — locks override everything, including your monitoring tools.

Quick recall

Q: A budget threshold is exceeded at 09:00. When do resources shut down? A: Never — budgets don't affect resources or stop consumption; they only trigger notifications (and optionally an action group).

Q: Which two cost alert types exist only on Enterprise Agreements? A: Credit alerts (Azure Prepayment, automatic at 90% and 100%) and department spending quota alerts.

Q: Scenario — a Contributor on a subscription wants to edit the amount of a budget the subscription Owner created. Allowed? A: Yes: Contributor can create/modify/delete their own budgets and can modify the amount of budgets created by others; full edit/delete of others' budgets needs Owner.

Q: At which scopes can a budget trigger an action group? A: Subscription and resource group scopes only.

Q: Which roles can view Azure Advisor recommendations, and which category covers Defender for Cloud items? A: Owner, Contributor, or Reader of a subscription, resource group, or resource; Defender for Cloud recommendations appear under Security.

Q: Scenario — you spun up a subscription an hour ago and Budgets won't load. Why? A: A new subscription can take up to 48 hours before Cost Management features are usable.

Coming up

Nothing — you've reached the end of the module. Look back at the road: Part I built the identity layer — the two planes of administration and four scope levels (Episode 1), then users, groups, licensing, B2B guests, and SSPR (Episodes 2–6). Part II wired up access with the Azure RBAC model and its day-to-day practice (Episodes 7–8). Part III governed the estate: organizing management groups, subscriptions, resource groups, and tags (Episode 9), enforcing standards with Azure Policy and locks (Episode 10), and finally watching the money with Cost Management, budgets, alerts, and Advisor (Episode 11). Who can act, on what, where, under which rules, at what cost — that is "Manage Azure Identities and Governance" in one sentence. Good luck on the exam.