← All posts · 2026-07-24

Azure budget alerts are not anomaly detection

Azure budgets are necessary and not sufficient. They answer one question: has total spend crossed a line I drew in advance? The expensive surprises live in a different question: is something spending differently than it ever has before?

What a budget alert cannot see

Say your subscription runs $18k a month and your budget alert fires at $20k. A service that normally costs $70 a day jumps to $240 on the 5th. That is a 3.4x anomaly, worth $5k a month, and your budget alert says nothing until the 20-something-th, because the total is still under the line. By the time it fires, the anomaly is weeks old and the month is already lost.

What a baseline sees

Anomaly detection keeps a rolling baseline per service and per day. When a day clears both a statistical threshold and a percentage jump against its own history, it gets flagged, with the service and resource group named and the delta quantified. The question changes from did we cross a line to did anything behave abnormally, and the answer arrives the next day.

Use both, they are different controls

The budget is your circuit breaker: coarse, reliable, tied to the number finance actually cares about. Anomaly detection is your smoke detector: early, specific, and attributable. One caps the damage, the other finds the fire while it is small.

You do not need an agent for this

Daily cost data already leaves Azure in the CSV that Cost Management exports. A baseline can be computed from that export alone, with no service principal, no reader role, and nothing new inside your tenant. The barrier to anomaly detection is not access; it is just deciding to look at the daily shape instead of the monthly total.