How to Set Up Real-Time Cost Alerts in Azure
Azure bills arrive at the end of the month. The spend that drives them happens throughout it. Without cost alerts, you find out a workload was mis-configured, a test environment ran all weekend, or a new integration generated unexpected egress charges weeks after the fact. Cost alerts change when you find out: from the invoice to within hours of the threshold being crossed.
This guide covers the full setup: prerequisites, budget creation, alert thresholds, notification channels, and automated responses that can act on a budget breach without waiting for a human.
Prerequisites: permissions and scope
Cost alerts require the Contributor role or higher on the scope where the budget is defined, or the Cost Management Contributor role, which grants budget management rights without broader resource permissions.
Read access (Cost Management Reader or Reader) is sufficient to view existing budgets and alerts. Creating or modifying them requires Contributor or Cost Management Contributor.
The scope determines what spend the budget covers. Budgets can be created at: - Management group: aggregates spend across all child subscriptions - Subscription: covers all resources in a subscription - Resource group: covers a specific resource group only - Specific resources: individual resources (available via CLI/API, not portal)
Most organisations create budgets at subscription level for team or project accountability, and a higher-level budget at management group or a parent subscription for overall oversight.
Cloud Solution Provider (CSP) customers manage billing through their partner and may have restricted access to Microsoft Cost Management depending on their partner's configuration.
Create a budget
In the Azure Portal, navigate to Cost Management + Billing > Cost Management > Budgets. Select + Add.
Budget name: descriptive and consistent. A convention like {environment}-{team}-{period} (e.g., production-engineering-monthly) makes budgets easy to scan across an estate.
Reset period: Monthly is standard. Quarterly works for departments that plan on a quarter. Annual is available but monthly gives more actionable alert cadence.
Creation and expiration dates: Set a creation date aligned with your billing cycle. Set an expiration date if the budget is for a finite project; otherwise, leave it open-ended.
Budget amount: Set this to your expected or acceptable spend for the period. This does not cap or restrict spending: Azure will spend above the budget if resources are consuming it. The budget controls alerting, not provisioning.
For accurate budgeting, run Azure Cost Explorer for the previous 3 months first to understand your baseline. Budget to your expected spend plus a margin for growth and anomalies: 10-15% above baseline is a reasonable starting point for a budget that should alert before becoming a problem.
Configure alert thresholds
Each budget supports up to five alert conditions. Each condition defines a percentage of the budget at which to trigger an alert, and whether to trigger on actual spend or forecasted spend.
Actual cost alerts trigger when cumulative spend since the budget reset date crosses the threshold. They are retrospective: the spend has happened.
Forecasted cost alerts trigger when Azure's cost forecast predicts the budget will be exceeded by the end of the period based on current spending patterns. They are predictive: they give you time to act before the budget is breached.
A practical alert structure for a monthly budget:
| Condition | Type | Threshold |
|---|---|---|
| Early warning | Actual | 50% |
| Elevated spend | Actual | 75% |
| Near limit | Forecasted | 80% |
| Budget breach | Actual | 90% |
| Overspend | Actual | 100% |
Receiving an alert at 50% actual spend early in the month is a signal to investigate. An alert at 100% actual mid-month is an emergency. Structuring alerts across both actual and forecasted thresholds at different percentages gives you graduated visibility.
Set up notification channels
Each alert condition has a contact field for email recipients. Enter the email addresses of the people who should receive the alert. This is sufficient for straightforward setups.
For operational teams that use Slack, Teams, or on-call tooling, email alerts are insufficient: they get missed or delayed. Use Action Groups instead.
Create an Action Group in Azure Monitor (Monitor > Alerts > Action groups > + Create). An Action Group defines one or more notification actions: email, SMS, voice call, Logic App, Function App, webhook, ITSM integration, or Azure Automation runbook.
For Slack, use a webhook: create an incoming webhook in Slack, configure a webhook action in the Action Group pointing to that URL, and cost alerts will post to the Slack channel with spend details.
For automated response (shut down a test environment when spend reaches 90%), use an Azure Automation runbook action. The runbook receives the alert context and can execute resource management commands. A runbook that deallocates VMs in a development resource group when the budget is nearly exhausted is a concrete cost control that does not require human intervention.
Associate the Action Group with a budget alert condition by selecting it in the budget alert configuration rather than entering an email address.
Automated response with Logic Apps
For more complex automated responses, Logic Apps provides a visual workflow designer. A Logic App triggered by a cost alert webhook can:
- Post a formatted message to Teams or Slack with breakdown of top cost drivers
- Create a ServiceNow or Jira ticket for the relevant team
- Query Cost Explorer API to attach a cost breakdown by resource group to the notification
- Trigger further approval or escalation workflows
The Logic App receives the alert payload in JSON format, including the budget name, the threshold that was crossed, and the amount spent. Use this data to build context into the notification rather than sending a generic "budget alert" message.
Monitor alert effectiveness
After setup, test the alerts. Azure Cost Management allows you to evaluate alerts without waiting for a threshold to be naturally crossed: set a test budget at a low amount and wait for the first day's spend to cross it, or adjust the threshold temporarily.
Review active alerts in Cost Management > Budgets. The budget list shows current spend against budget, percentage consumed, and last alert triggered. If alerts are not triggering when expected, check: - The alert has active notification recipients or a valid Action Group - The subscription or resource group scope is correct and covers the resources generating spend - The budget period matches the billing period you are monitoring
Monthly, review budget accuracy. If actual spend is consistently well below budget, adjust downward to sharpen the signal. If you are regularly hitting thresholds early, either the budget needs increasing or there is a spending problem to investigate.
UK-specific configuration
Set the currency to GBP in Cost Management settings to display all amounts in pounds sterling rather than USD. This matters for alert email content, budget amounts, and dashboard displays. Azure's billing currency depends on your agreement, but the display currency in Cost Management is configurable.
Date formats in Cost Management reports default to M/D/YYYY. Export configurations and dashboards shared with UK teams should use DD/MM/YYYY for consistency with local conventions.
If your organisation reports costs in multiple currencies (a UK subsidiary of a multinational with USD billing), configure budgets in the billing currency and use separate Cost Management views filtered by subscription for reporting in the local currency.
Where Critical Cloud comes in
Cost alerting is a basic control that every Azure environment should have, but getting the thresholds, scopes, and escalation paths right, and actually acting on the alerts, is where most teams fall short. We manage Azure cost visibility as part of operating the platform for regulated and technology-led businesses, with spend monitoring integrated into the same operational view as reliability and security signals. If your Azure costs are growing faster than your understanding of what is driving them, see how Critical Support works.