Azure Cost Management: Ultimate Guide for DevOps Engineers

By Raúl Pérez · Last updated: October 2026 · Reading time: 12 min

Azure bills have a way of growing quietly. A test cluster that nobody switched off, a premium disk left behind after a VM was deleted, a production database sized for a launch that happened two years ago. Individually these look harmless. Together they are often 20 to 35 percent of a monthly invoice, and the engineers who created them rarely see the bill.

This guide is written for DevOps engineers, platform teams and cloud architects who are now expected to own cost as well as uptime. We will walk through Azure Cost Management end to end: how the tooling works, how to structure your scopes and tags, how to set budgets and alerts, how to find and remove waste with code, and how to choose between reservations, savings plans and Spot capacity.

By the end you will have a repeatable operating model, not just a list of tips.

What Is Azure Cost Management?

Azure Cost Management (part of Microsoft Cost Management + Billing) is the native toolset for monitoring, allocating and optimizing spend on Azure. It lives in the Azure portal and is also exposed through APIs and the CLI. Its main capabilities are:

• Cost analysis: interactive views of actual and amortized cost, grouped and filtered by service, resource group, tag, location and more.
• Budgets: spending thresholds with alerts and optional automated actions.
• Alerts and anomaly detection: notifications for budget breaches, credit usage and unexpected spikes.
• Exports: scheduled delivery of detailed cost data to a storage account, ready for Power BI, a data warehouse or custom scripts.
• Cost allocation rules: redistribution of shared costs to teams or applications.
• Advisor recommendations: rightsizing, idle resource and reservation suggestions.

For Azure scopes, the core Cost Management features are available at no additional charge, so there is no reason not to use them before buying a third-party tool. Pricing and feature availability can change, so confirm current details in Microsoft’s documentation.

Step 1: Understand Scopes Before You Touch Anything

Every view and budget in Azure Cost Management is tied to a scope. Getting this wrong is the most common reason teams say “I can’t see our costs.”

The scope hierarchy, from broadest to narrowest, is:

1. Billing account (Enterprise Agreement or Microsoft Customer Agreement)
2. Management group
3. Subscription
4. Resource group
5. Resource

A few practical rules:

• Finance and FinOps leads typically work at the billing account or management group level.
• Engineering managers usually need subscription-level access.
• Developers should see their own resource group at minimum. Grant the Cost Management Reader role instead of broader roles like Reader or Contributor.
• Management group scope lets you see costs across subscriptions, which is essential if you use one subscription per environment or per team.

A clean subscription structure pays off later. A common pattern is one subscription per workload and environment (for example payments-prod, payments-dev), grouped under management groups by business unit. This makes budgets and chargeback trivial compared with a single giant subscription full of mixed resources.

Step 2: Use Cost Analysis the Right Way

Open Cost Management → Cost analysis and resist the urge to stare at the total. These views answer real questions:

• Group by Service name: where is the money going? Usually virtual machines, storage, databases and networking dominate.
• Group by Resource group, then Resource: which specific resources are the top 10 spenders?
• Group by Tag: how much does each team or application cost (only as good as your tagging, covered below)?
• Granularity set to Daily: spot sudden jumps and match them to deployments.
• Actual cost vs Amortized cost: actual cost shows cash outlay, including a large one-time reservation purchase. Amortized spreads that purchase across the term, which is what you want when comparing teams or tracking unit costs.

Save the views you use weekly as custom views and pin them to a dashboard. A good starting set is: top 10 resources, cost by environment tag, cost by service for the last 3 months, and untagged spend.

Query costs from the CLI

DevOps teams love automation, and cost data is no exception. The Cost Management query API can be called through the CLI:

# Cost for the current month grouped by resource group
az costmanagement query \
  --type ActualCost \
  --scope "subscriptions/<SUBSCRIPTION_ID>" \
  --timeframe MonthToDate \
  --dataset-aggregation '{"totalCost":{"name":"Cost","function":"Sum"}}' \
  --dataset-grouping name="ResourceGroupName" type="Dimension"

Depending on your CLI version you may need the costmanagement extension (az extension add --name costmanagement). Check az costmanagement query --help for current parameters.

Step 3: Build a Tagging Strategy That Survives Reality

Tags are the backbone of cost allocation. Without them, a shared subscription is an opaque pile of spend.

Keep the required set small, because large tag schemas are ignored. A practical minimum:

Tag	Example values	Purpose
environment	prod, staging, dev	Separate production from disposable spend
team	payments, search, data	Chargeback and ownership
application	checkout-api	Application-level cost
cost-center	CC-4410	Finance mapping
owner	email or alias	Who to ask before deleting

Enforce tags with Azure Policy

Voluntary tagging fails. Use Azure Policy to require tags on resource groups and to inherit them down to resources. Microsoft provides built-in definitions such as Require a tag on resource groups and Inherit a tag from the resource group if missing.

# Assign the built-in "Inherit a tag from the resource group if missing" policy
az policy assignment create \
  --name inherit-team-tag \
  --display-name "Inherit team tag from resource group" \
  --policy "<BUILT_IN_POLICY_DEFINITION_ID>" \
  --params '{"tagName": {"value": "team"}}' \
  --scope "/subscriptions/<SUBSCRIPTION_ID>" \
  --mi-system-assigned \
  --location westeurope

The inherit policy uses the modify effect, so the assignment needs a managed identity with permission to update tags. Remember that not every Azure resource type supports tags and that tag data in cost views can lag behind by a day or so.

A useful habit: review a saved cost view filtered to untagged resources every week and fix the biggest offenders first.

Step 4: Set Budgets and Alerts Before You Need Them

A budget is not a spending cap. By default it is an alerting mechanism, which is exactly what you want: a warning before the invoice arrives.

In Cost Management → Budgets, create budgets per subscription, resource group or tag filter. Recommended thresholds:

• 50% of budget (actual): informational, sent to the team channel.
• 80% of budget (actual): warning, sent to the engineering manager.
• 100% of forecasted: early warning that you are on track to overspend, even if you have not yet.
• 100% of actual: escalation to finance and leadership.

Forecast-based alerts are the most valuable because they give you time to act in the middle of the month, not after it.

Create a budget with an ARM or Bicep template

targetScope = 'subscription'

resource budget 'Microsoft.Consumption/budgets@2023-05-01' = {
  name: 'monthly-dev-budget'
  properties: {
    category: 'Cost'
    amount: 2000
    timeGrain: 'Monthly'
    timePeriod: {
      startDate: '2026-11-01T00:00:00Z'
    }
    notifications: {
      actual80: {
        enabled: true
        operator: 'GreaterThan'
        threshold: 80
        contactEmails: ['platform-team@example.com']
        thresholdType: 'Actual'
      }
      forecast100: {
        enabled: true
        operator: 'GreaterThan'
        threshold: 100
        contactEmails: ['platform-team@example.com']
        thresholdType: 'Forecasted'
      }
    }
  }
}

Budgets can also trigger an action group, which can call a webhook, Logic App or Azure Function. Some teams use this to shut down non-production environments automatically when a hard threshold is crossed. Do this carefully and only on dev and test scopes.

Turn on anomaly alerts

Anomaly detection in Cost Management flags unusual daily spend patterns based on your historical usage. Enable it at the subscription scope and route notifications to the same channel as your budgets. A runaway deployment loop or a misconfigured data pipeline will often show up here first.

Step 5: Find and Remove Waste With Azure Advisor and Resource Graph

Once visibility is in place, start cutting. There are two complementary sources: Azure Advisor and your own queries.

Azure Advisor cost recommendations

Advisor analyzes usage telemetry and suggests:

• Shutting down or resizing underused virtual machines
• Right-sizing or shutting down underused databases
• Buying reservations or savings plans for steady workloads
• Deleting unattached disks and unused public IPs, depending on the recommendation set available in your tenant

Treat Advisor as a starting list, not a command. It looks at utilization over a limited window, so validate a recommendation with the workload owner before resizing something like a month-end batch server.

Find orphaned resources with Azure Resource Graph

Resource Graph lets you query across subscriptions in seconds. These queries are a staple of any Azure cleanup:

Unattached managed disks

Resources
| where type =~ 'microsoft.compute/disks'
| where isnull(managedBy) and properties.diskState =~ 'Unattached'
| project name, resourceGroup, subscriptionId, sku = sku.name,
          sizeGb = properties.diskSizeGB, location

Unassociated public IP addresses

Resources
| where type =~ 'microsoft.network/publicipaddresses'
| where isnull(properties.ipConfiguration) and isnull(properties.natGateway)
| project name, resourceGroup, subscriptionId, sku = sku.name, location

Network interfaces not attached to any VM

Resources
| where type =~ 'microsoft.network/networkinterfaces'
| where isnull(properties.virtualMachine)
| project name, resourceGroup, subscriptionId, location

Run them from the CLI to feed a weekly report:

az graph query -q "Resources | where type =~ 'microsoft.compute/disks' | where isnull(managedBy) | project name, resourceGroup, sizeGb=properties.diskSizeGB"

Before deleting anything, snapshot or tag it with a deletion date and notify the owner tag. A “quarantine for 14 days” policy prevents most horror stories.

Step 6: Right-Size Compute and Databases

Compute is typically the largest line on an Azure invoice, so right-sizing has the highest return.

1. Collect at least 2 to 4 weeks of metrics. Look at average and peak CPU, memory and network, not just one day.
2. Move down one size at a time. Dropping from a D8 to a D4 and measuring is safer than jumping to a D2.
3. Consider newer VM generations. Newer series often provide better price-performance than older ones for the same workload.
4. Evaluate burstable B-series VMs for workloads with low baseline CPU and occasional spikes, such as dev servers and small internal tools. Monitor CPU credits so you do not throttle yourself.
5. Check storage tiers. Premium SSD disks on a lightly used dev VM are often unnecessary. Standard SSD may be enough.
6. Review database tiers and DTU or vCore sizing. Azure SQL and PostgreSQL instances are commonly oversized after launch. Serverless options can pause automatically for intermittent workloads.

Step 7: Switch Off What Nobody Uses at Night

Non-production environments running 24/7 are pure waste. A VM that runs only during business hours (roughly 50 of 168 hours per week) can cost about 70 percent less in compute charges, although attached disks still bill while the VM is deallocated.

Options, from simplest to most flexible:

• Auto-shutdown on VMs: a built-in setting for dev and test VMs, configured per machine.
• Azure Automation or Logic Apps: schedule start and stop across tagged resources.
• Azure DevTest Labs: policies for auto-shutdown and auto-start across lab VMs.
• AKS: stop non-production clusters outside working hours, or scale user node pools to zero.

# Deallocate all VMs tagged environment=dev in a resource group (compute billing stops)
az vm deallocate --ids $(az vm list -g my-dev-rg \
  --query "[?tags.environment=='dev'].id" -o tsv)

Remember to deallocate, not just stop from inside the guest OS. A VM that is stopped but not deallocated continues to accrue compute charges.

Step 8: Commit Smartly With Reservations and Savings Plans

For steady-state workloads, commitment discounts are the largest single lever. Azure offers two main models:

	Azure Reservations	Azure Savings Plan for Compute
What you commit to	A specific resource type, size and region (for example, a VM family)	A fixed hourly spend on compute
Flexibility	Lower, though instance size flexibility and exchanges may apply in some cases	Higher, applies across VM families, regions and some other compute services
Typical discount	Generally the deeper of the two	Slightly lower than reservations in many cases
Terms	1 or 3 years	1 or 3 years
Best for	Stable, predictable workloads	Changing or mixed compute footprints

Microsoft advertises substantial discounts versus pay-as-you-go pricing, in the range of tens of percent depending on the service, term and region. Exact discounts and exchange or refund policies change over time, so verify them on the official pricing pages before purchasing.

A safe sequence:

1. Right-size first. Never commit to waste.
2. Cover your stable baseline (what runs 24/7 and will for the next year) with reservations or a savings plan.
3. Leave the variable portion on pay-as-you-go or Spot.
4. Review utilization of your commitments monthly. Cost Management includes reservation utilization reports.

Other discounts to check

• Azure Hybrid Benefit: if you hold eligible Windows Server or SQL Server licenses with Software Assurance, you can apply them on Azure to reduce compute costs.
• Dev/Test pricing: eligible Visual Studio subscribers can access discounted rates for non-production workloads.
• Spot VMs: deeply discounted capacity that Azure can evict when it needs the resources back. Good for batch jobs, CI runners and fault-tolerant workloads, not for databases.

Step 9: Allocate Shared Costs and Build a Showback Culture

Tags cannot split everything. Shared Kubernetes clusters, networking hubs and platform services serve many teams. Use cost allocation rules in Cost Management to redistribute shared costs by percentage, compute usage or other criteria, so that team reports reflect their real share.

Then make the data visible:

• Showback: send teams a monthly report of their costs without charging them yet.
• Chargeback: eventually bill internal budgets based on consumption.
• Exports and Power BI: schedule a daily cost export to a storage account and build dashboards on top of it. Many organizations use the FinOps Foundation’s FOCUS specification to standardize cost data across clouds.

Cost becomes an engineering metric when teams see it next to latency and error rate.

Step 10: Add Cost Checks to Your CI/CD Pipeline

Shift cost left. Catching an expensive configuration in a pull request is much cheaper than finding it on the invoice.

• Infrastructure as code reviews: require a review for changes that introduce premium SKUs, large VM sizes or new regions.
• Policy as code: use Azure Policy to deny very large VM SKUs in dev subscriptions or to restrict allowed regions.
• Cost estimation tools: tools such as Infracost can show the monthly cost delta of a Terraform or Bicep change directly in the pull request.
• Ephemeral environments: create preview environments per pull request and destroy them automatically on merge.

A 30-Day Azure Cost Management Plan

Week 1: Visibility

• Confirm scopes and roles; grant Cost Management Reader to engineers.
• Save core cost analysis views.
• Enable anomaly alerts.

Week 2: Governance

• Define the tag schema and enforce it with Azure Policy.
• Create monthly budgets with forecast alerts per subscription.

Week 3: Waste removal

• Run Resource Graph queries for orphaned resources.
• Review Advisor recommendations with owners.
• Schedule shutdowns for non-production environments.

Week 4: Commitments and culture

• Right-size, then evaluate reservations or a savings plan for the stable baseline.
• Send the first showback report.
• Add a cost review item to your monthly engineering meeting.

Common Mistakes to Avoid

• Buying commitments before right-sizing. You lock in the waste for 1 to 3 years.
• Treating budgets as hard limits. They alert by default; automation is needed to act.
• Deleting resources without checking ownership. Always notify the owner and quarantine first.
• Ignoring data transfer and networking costs. Cross-region traffic and egress can surprise you.
• Looking only at actual cost. Use amortized views to compare teams and months fairly.

Frequently Asked Questions

Is Azure Cost Management free? For Azure scopes, the native Cost Management features are available at no additional cost. Costs for other clouds connected through Microsoft’s multicloud capabilities and third-party tools may be priced differently, so check current terms.

How often is cost data updated? Usage data is typically refreshed several times per day, but can take up to roughly a day to fully appear, and some resource types lag more than others.

What is the difference between a budget and a spending limit? A budget sends alerts and can trigger automation. It does not stop resources by itself. Hard spending limits exist only for certain offers such as some free or credit-based subscriptions.

Should I choose reservations or a savings plan? Choose reservations for stable, well-understood workloads where you want the deepest discount. Choose a savings plan when your compute mix changes often. Many mature teams use both.

Do I need a third-party FinOps tool? Not at the start. Native tooling covers visibility, budgets and recommendations. Third-party platforms become useful for multicloud environments, advanced allocation, and unit economics reporting.

Conclusion

Azure Cost Management gives DevOps teams everything required to move from reactive bill shock to proactive cost control. Start with scopes and tags, add budgets and anomaly alerts, remove orphaned resources, right-size before you commit, and make cost visible to the engineers who create it. Repeat monthly, and you will keep your Azure spend in line with the value it delivers.