Budgets Without Alerts Are Just Spreadsheet Numbers
Setting a cloud budget is the easy part. The hard part is knowing when you are about to blow through it — early enough to do something about it. In the on-premises world, hardware costs were fixed and predictable. In Azure, a forgotten autoscaler or a runaway data pipeline can burn through a quarterly budget in a weekend. Without automated alerts tied to budget thresholds, the first time anyone notices the overspend is when the invoice arrives weeks later.
Azure Cost Management budgets create a financial boundary around any scope — subscription, resource group, management group, or billing account — and fire alerts when spending approaches or exceeds defined thresholds. These alerts can send emails, trigger automation runbooks that shut down non-critical resources, or invoke Logic Apps that open ITSM tickets. This guide covers every aspect of building effective budget alert systems, from basic email notifications to fully automated cost control workflows.
Creating Your First Budget
Navigate to the desired scope in the Azure portal (subscription or resource group), open Budgets from the left navigation under Cost Management, and click Add.
Budget Configuration Options
Every budget requires these core settings:
- Name — A descriptive identifier (you cannot change this later)
- Reset period — How often the budget resets to zero. Options include Monthly, Quarterly, Annually, and billing-aligned periods (BillingMonth, BillingQuarter, BillingAnnual for pay-as-you-go accounts)
- Amount — The dollar threshold. Azure suggests an amount based on the highest forecasted cost for the scope
- Expiration date — When the budget stops being evaluated. Expired budgets are automatically deleted
- Filters — Optionally narrow the budget to specific resource groups, tags, services, or other dimensions. A budget filtered to
environment: productiononly tracks production resources within the scope
Configuring Alert Thresholds
Each budget supports up to five actual cost notifications and five forecasted cost notifications. The distinction between these two types is critical:
| Alert Type | Triggers When | Best For |
|---|---|---|
| Actual cost | Accumulated spend exceeds the threshold percentage | Reactive — you have already spent the money |
| Forecasted cost | Projected spend is likely to exceed the threshold | Proactive — you can act before the overspend happens |
A practical alert configuration uses both types at staggered thresholds:
- 50% Actual — Informational checkpoint at the midpoint
- 75% Actual — Warning that triggers review of current spending
- 90% Actual — Critical alert that triggers cost containment actions
- 100% Forecasted — Early warning that you are on track to exceed the budget
- 110% Forecasted — Alert that forecasts a significant overspend
Threshold values can range from 0.01% to 1000% of the budget amount. Costs are evaluated every 24 hours, and alert emails are sent within one hour of a threshold breach.
Connecting Alerts to Action Groups
Email notifications are useful for awareness, but they do not prevent overspend on their own. Action groups connect budget alerts to automated responses that can actually contain costs.
Action Group Capabilities
An Azure Monitor action group (microsoft.insights/actionGroups) bundles multiple response actions under a single configuration. Budget alerts support action groups at subscription and resource group scopes. The available action types include:
| Action Type | Use Case |
|---|---|
| Notify individuals or distribution lists | |
| SMS | Immediate mobile notification (bidirectional — recipients can reply STOP) |
| Voice call | Escalation for critical budget breaches |
| Automation Runbook | Execute PowerShell runbook to shut down VMs, scale down services |
| Azure Function | Call HTTP-triggered function for custom logic |
| Logic App | Trigger workflow for Teams notification, ITSM ticket, approval routing |
| Webhook | HTTP POST to external system (retries: 5 attempts at 5, 20, 5, 40, 5-second intervals) |
| Event Hub | Stream alert to Event Hubs for custom processing |
Example: Budget Alert with VM Shutdown Runbook
A common pattern pairs a 90% actual cost alert with an Automation Runbook that deallocates non-production VMs. The portal offers built-in runbooks for common actions — select one from the dropdown when configuring the action group, and Azure handles the managed identity and role assignment automatically.
The flow works like this: budget cost evaluation detects that the threshold is breached → alert fires → action group invokes the runbook → runbook queries VMs in the scope, filters by tag (e.g., criticality: low), and deallocates them. The result is automated cost containment that responds to real spending data without human intervention.
Important: Azure budgets do not stop resource consumption automatically. When a threshold is exceeded, resources continue running and accruing charges. Any shutdown or scale-down must be explicitly implemented through action group automation.
Deploying Budgets as Infrastructure-as-Code
Managing budgets through the portal works for a handful of subscriptions. For organizations with dozens or hundreds of subscriptions, infrastructure-as-code deployment ensures every scope has consistent budget coverage.
Bicep Template
targetScope = 'subscription'
param budgetAmount int = 5000
param startDate string = '2026-04-01T00:00:00Z'
param contactEmails array = ['finops@contoso.com']
param actionGroupId string = ''
resource monthlyBudget 'Microsoft.Consumption/budgets@2024-08-01' = {
name: 'monthly-subscription-budget'
properties: {
amount: budgetAmount
category: 'Cost'
timeGrain: 'Monthly'
timePeriod: {
startDate: startDate
}
notifications: {
Actual_GreaterThan_75: {
contactEmails: contactEmails
contactGroups: actionGroupId != '' ? [actionGroupId] : []
contactRoles: ['Owner', 'Contributor']
enabled: true
operator: 'GreaterThan'
threshold: 75
thresholdType: 'Actual'
}
Actual_GreaterThan_90: {
contactEmails: contactEmails
contactGroups: actionGroupId != '' ? [actionGroupId] : []
contactRoles: ['Owner']
enabled: true
operator: 'GreaterThan'
threshold: 90
thresholdType: 'Actual'
}
Forecasted_GreaterThan_100: {
contactEmails: contactEmails
contactRoles: ['Owner', 'Contributor']
enabled: true
operator: 'GreaterThan'
threshold: 100
thresholdType: 'Forecasted'
}
}
}
}Deploy this template across all subscriptions using a management group-level deployment that iterates through child subscriptions. Each subscription gets the same budget structure with environment-specific amounts provided as parameters.
REST API for Programmatic Budget Management
# Create or update a budget via REST API
$subscriptionId = "your-subscription-id"
$budgetName = "monthly-cost-budget"
$token = (Get-AzAccessToken -ResourceUrl https://management.azure.com).Token
$body = @{
properties = @{
category = "Cost"
amount = 10000
timeGrain = "Monthly"
timePeriod = @{
startDate = "2026-04-01T00:00:00Z"
endDate = "2027-04-01T00:00:00Z"
}
notifications = @{
"Actual_GreaterThan_80" = @{
enabled = $true
operator = "GreaterThan"
threshold = 80
thresholdType = "Actual"
contactEmails = @("team@contoso.com")
locale = "en-us"
}
"Forecasted_GreaterThan_100" = @{
enabled = $true
operator = "GreaterThan"
threshold = 100
thresholdType = "Forecasted"
contactEmails = @("team@contoso.com")
locale = "en-us"
}
}
}
} | ConvertTo-Json -Depth 10
$uri = "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.CostManagement/budgets/${budgetName}?api-version=2025-03-01"
$headers = @{ Authorization = "Bearer $token"; "Content-Type" = "application/json" }
Invoke-RestMethod -Uri $uri -Method PUT -Headers $headers -Body $bodyBudget Alerts vs. Anomaly Alerts
Budgets and anomaly alerts serve complementary purposes and should be used together rather than as alternatives.
| Aspect | Budget Alerts | Anomaly Alerts |
|---|---|---|
| Purpose | Governance against known spending limits | Detection of unexpected spending patterns |
| Configuration | Manual — you define the amount and thresholds | Automatic — ML detects unusual patterns |
| Trigger | Percentage of a set dollar amount | Deviation from established cost patterns |
| Scope | Any billing or RBAC scope | Subscription (create from Cost Analysis) |
| Action groups | Yes (subscription/RG scope) | Yes |
A budget alert at 90% tells you the subscription is approaching its planned limit — this might be expected if business traffic is growing. An anomaly alert tells you that today’s spending is significantly different from the established pattern — this usually means something unexpected happened, like a misconfigured autoscaler, a data breach generating egress charges, or a developer accidentally deploying to the production subscription.
Configure both: budgets for known financial boundaries, anomaly alerts for unknown threats.
Budget Scope Strategy
Where you create budgets determines what they protect and who gets alerted.
Subscription-Level Budgets
The most common scope. Each subscription gets a budget reflecting its expected monthly spend. Alert recipients include the subscription owner and the FinOps team. Action groups can trigger automation within the subscription scope.
Resource Group-Level Budgets
Useful for tracking specific applications or team allocations within a shared subscription. A budget on rg-ml-training alerts the data science team when their GPU costs approach the allocated amount, without affecting or alerting other teams in the same subscription.
Management Group-Level Budgets
Provides an umbrella budget across all child subscriptions. Requires that all subscriptions use the same billing currency. Management group budgets are ideal for department-level or business unit-level spending governance.
Filtered Budgets
Budgets support the same filters as Cost Analysis: resource groups, tags, services, regions, and other dimensions. A single subscription can have multiple filtered budgets — one for production resources (tag: environment: prod), one for development resources, and one for shared infrastructure. This provides environment-level spending governance within a single subscription.
Automation Patterns for Cost Control
Budget alerts become a cost control system when connected to automation that responds to threshold breaches.
Pattern 1: Non-Critical Resource Shutdown
Budget at 90% actual → Action group → Automation Runbook → Deallocate VMs tagged criticality: low. This preserves disks and configurations while stopping the compute charges that typically dominate the bill. Resources can be restarted when the new budget period begins.
Pattern 2: Scale-Down via Azure Function
Budget at 80% actual → Action group → Azure Function → Resize App Service plans from Premium to Standard tier, reduce AKS node pool minimum counts, switch Cosmos DB containers from provisioned to autoscale. The function uses managed identity authentication and targets specific resources based on tags.
Pattern 3: Approval-Based Containment
Budget at 100% forecasted → Action group → Logic App → Teams adaptive card requesting manager approval → If approved, Logic App calls runbook for scale-down. This adds a human checkpoint for cases where automated shutdown would affect production services, while still ensuring the alert is acted upon promptly.
Pattern 4: ITSM Integration
Budget at 75% actual → Action group → Webhook → ServiceNow or Jira → Creates a “cost review” ticket assigned to the engineering team. This integrates cost governance into existing incident management workflows rather than creating a separate notification channel that might be ignored.
Best Practices for Budget Alert Configuration
Set forecasted alerts at lower thresholds than actual alerts. A forecasted alert at 80% gives you time to act before the money is spent. An actual alert at 80% confirms that 80% has already been spent and the remaining 20% may not last the rest of the period.
Use percentage thresholds above 100% for actual cost alerts. A budget at 110% actual catches overspend that happened before the 100% alert was acted upon. Since costs can be delayed by up to 72 hours, the actual spend might already be at 105% by the time the 100% alert fires.
Set long expiration dates on budgets. Expired budgets are automatically deleted, removing both the budget tracking and all associated alerts. Set expiration dates three years out and add calendar reminders to review and renew before they expire.
Include contactRoles in notifications. Adding Owner and Contributor roles to the notification means that even as team members change, the people with resource access continue receiving alerts without manual email list maintenance.
Review budget amounts quarterly. A budget set 12 months ago based on a smaller footprint may be chronically exceeded, creating alert fatigue that desensitizes the team to legitimate warnings. Adjust amounts to reflect current baselines while keeping thresholds that represent meaningful governance boundaries.
Budget alerts are the first automated guardrail most organizations implement in their FinOps practice. They cost nothing to configure, require minimal maintenance, and provide the safety net that prevents the worst-case scenario: discovering a significant overspend weeks after it happened, with no opportunity to have prevented it. Configure them broadly, automate the responses aggressively, and treat every alert as a signal that deserves at least a brief investigation.