This chapter covers cost alerts and budget thresholds in Microsoft Azure, a critical topic for the Monitoring domain (Objective 5.3) of the AZ-104 exam. Understanding how to set up budgets, configure alerts based on threshold percentages or amounts, and interpret cost data is essential for controlling cloud spending. Expect approximately 5-10% of exam questions to touch on cost management, alerting, and budget configuration, often in the context of governance and cost optimization scenarios.
Jump to a section
Imagine you are the budget officer for a large corporation with multiple departments. Each department has a spending limit (budget) that you set at the beginning of the fiscal year. You configure automated alerts: when a department reaches 80% of its budget, you get an email; at 100%, you get a text message and the department head gets a warning; at 120%, the department's purchasing cards are automatically frozen. The alerts are based on actual spending data that is updated every few hours. If a department's spending spikes unexpectedly, you can investigate before it blows the budget. In Azure, cost alerts work similarly: you set budget thresholds (e.g., at 80%, 100%, 120% of your spending limit), and when actual or forecasted costs hit those thresholds, Azure sends email notifications or triggers an action group (e.g., run a runbook to shut down resources). The cost data is refreshed multiple times per day, so alerts are near real-time. Just as you might have multiple budgets for different departments, Azure allows you to create budgets at subscription, resource group, or service level, with multiple thresholds per budget. And like the corporate example, you can set alerts on both actual costs (what you've already spent) and forecasted costs (predicted spend based on current trends) to get ahead of overspending.
What Are Cost Alerts and Budget Thresholds?
Cost alerts and budget thresholds are Azure Cost Management features that enable you to monitor and control your Azure spending. A budget is a spending limit you define for a scope (subscription, resource group, management group, or billing account). You set one or more thresholds as percentages of the budget amount (e.g., 50%, 100%, 120%). When actual or forecasted costs reach a threshold, Azure triggers an alert that can send email notifications or invoke an action group (e.g., run a runbook, send an SMS, or trigger a webhook).
Why They Exist
Cloud spending can easily spiral out of control without proper monitoring. Cost alerts provide proactive notifications before you exceed your budget, allowing you to take corrective action (e.g., shut down non-critical resources, scale down, or adjust reserved instances). Budget thresholds give you granular control: you can be warned at 80% (nearly there), alerted at 100% (at limit), and alerted again at 120% (over limit). This helps prevent surprise bills and supports cost governance.
How It Works Internally
Azure Cost Management collects usage and billing data from Azure Resource Manager (ARM) and the billing system. Data is aggregated and refreshed at least twice per day (typically every 4-8 hours). When you create a budget, you specify: - Scope: Subscription, resource group, management group, or billing account. - Budget amount: A monetary value (e.g., $1000). - Thresholds: Each threshold is a percentage of the budget (e.g., 80%, 100%) or a specific amount (e.g., $800). - Time period: Monthly, quarterly, or annual. For monthly budgets, the budget resets each month; for annual, it resets yearly. - Start and end dates: The budget is active during this period. - Actions: Email recipients and/or action group to trigger.
Azure evaluates actual and forecasted costs against the threshold. Actual costs are the charges already incurred. Forecasted costs are predicted using machine learning based on historical usage patterns. If either crosses a threshold, an alert is fired.
Key Components and Defaults
Budget amount: No default; you must specify.
Thresholds: Up to 10 thresholds per budget.
Alert frequency: Alerts are evaluated every time cost data is refreshed (multiple times per day). There is no configurable evaluation interval; it's based on data refresh.
Email notifications: You can add up to 50 email recipients per alert.
Action groups: You can associate one action group per threshold. Action groups can send email, SMS, voice call, or run an automation runbook.
Budget reset: For monthly budgets, the budget resets on the first day of each month at midnight UTC. For annual, it resets on the anniversary date.
Forecast alerts: These are based on projected costs for the current period. A forecast alert may fire even if actual costs are below the threshold.
Cost data latency: Usage data can take up to 24-48 hours to appear in Cost Management. Alerts are based on the latest available data, so there can be a delay.
Configuration and Verification Commands
You can create budgets and alerts via the Azure portal, PowerShell, Azure CLI, or REST API.
Azure CLI example to create a budget:
az consumption budget create \
--budget-name "MonthlyBudget" \
--amount 1000 \
--time-grain monthly \
--start-date 2025-01-01 \
--end-date 2025-12-31 \
--scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
--notifications "{\"thresholdType\":\"Actual\",\"threshold\":80,\"enabled\":true,\"contactEmails\":[\"admin@contoso.com\"]}" \
--notifications "{\"thresholdType\":\"Forecasted\",\"threshold\":100,\"enabled\":true,\"contactEmails\":[\"admin@contoso.com\"]}"PowerShell example:
New-AzConsumptionBudget -Name "MonthlyBudget" -Amount 1000 -TimeGrain Monthly -StartDate "2025-01-01" -EndDate "2025-12-31" -Scope "/subscriptions/00000000-0000-0000-0000-000000000000" -Notification (New-AzConsumptionBudgetNotification -Threshold 80 -ThresholdType Actual -Enabled $true -ContactEmail "admin@contoso.com")Verification:
az consumption budget show --budget-name "MonthlyBudget"Interaction with Related Technologies
Azure Policy: You can use Azure Policy to enforce budget creation on all subscriptions.
Action Groups: Budget alerts can trigger action groups, which can run automation runbooks (e.g., shut down VMs) or send notifications to Slack/Teams via webhooks.
Cost Management + Billing: Budgets are part of the Cost Management service, which also provides cost analysis, recommendations, and invoice data.
Management Groups: Budgets can be applied at management group scope to aggregate costs across multiple subscriptions.
Azure Advisor: Advisor provides cost recommendations that can help you stay within budget.
Step-by-Step Configuration in Portal
Navigate to Cost Management + Billing > Cost Management > Budgets.
Click +Add.
Scope: Select the scope (e.g., subscription).
Name: Enter a descriptive name.
Budget amount: Enter the monetary limit.
Reset period: Choose monthly, quarterly, or annual.
Expiration date: Set start and end dates.
Set alerts: Define threshold percentage (e.g., 80%) and choose whether to alert on actual or forecasted costs.
Action group: Optionally select an action group.
Email recipients: Add email addresses.
Click Create.
Important Notes for the Exam
Budgets are not enforced (they do not block spending). They only alert.
You can have multiple budgets on the same scope.
Forecast alerts are based on projected costs; they can fire even if actual costs are below the threshold.
The maximum number of budgets per scope is 100.
Budget alerts are evaluated at least once per day, but cost data can be up to 48 hours old.
You can set thresholds as percentages (e.g., 80%) or specific amounts (e.g., $800).
Action groups can be used to automate remediation (e.g., run a runbook to stop VMs).
The exam may ask about the difference between budget alerts and cost alerts in Cost Management. Budget alerts are the primary mechanism; there are also anomaly alerts and scheduled alerts.
Common Exam Scenarios
Scenario: You need to be notified when a subscription's spending reaches 90% of the budget. Solution: Create a budget with a threshold at 90%.
Scenario: You want to automatically shut down a VM when the budget is exceeded. Solution: Create a budget with a threshold at 100%, associated with an action group that runs an Automation runbook to stop the VM.
Scenario: You want to be alerted if forecasted costs will exceed the budget by the end of the month. Solution: Create a budget with a forecasted threshold at 100%.
Trap Patterns on the Exam
Trap: Confusing budget alerts with cost anomaly alerts. Budget alerts are threshold-based; anomaly alerts detect unusual spending patterns.
Trap: Thinking budgets block spending. They do not; they only alert.
Trap: Assuming alerts are real-time. Data refreshes multiple times a day, but there is latency.
Trap: Setting a budget at resource level. Budgets can be set at subscription, resource group, management group, or billing account, but not at individual resource level (though you can filter by resource tag).
Trap: Using incorrect threshold type (actual vs forecasted) for the requirement.
Summary of Technical Details
Budget scope: Subscription, resource group, management group, billing account.
Time grain: Monthly, quarterly, annual.
Thresholds: Up to 10 per budget, percentage or amount.
Alert triggers: Actual or forecasted cost.
Actions: Email (up to 50 recipients) or action group.
Data refresh: Multiple times per day, up to 48-hour latency.
Maximum budgets per scope: 100.
Budget reset: At start of period (monthly on 1st, annually on start date).
Understanding these details will help you answer exam questions accurately and configure cost alerts effectively in the real world.
Define budget scope and amount
First, determine the scope of the budget: a management group, subscription, resource group, or billing account. The scope defines which costs are tracked. For example, a subscription-level budget tracks all costs within that subscription. Next, set the budget amount (e.g., $5,000). This is the spending limit for the chosen time period (monthly, quarterly, or annual). The budget amount can be a fixed number or based on a previous month's spend. In the portal, you enter this as a dollar value. In CLI, use the --amount parameter. The budget is created with a start and end date; the budget resets at the beginning of each period (e.g., monthly on the 1st).
Configure alert thresholds
Each budget can have up to 10 alert thresholds. A threshold is a percentage (e.g., 80%) or a specific dollar amount (e.g., $4,000) of the budget. You specify whether the alert triggers on actual costs or forecasted costs. Actual costs are charges already incurred; forecasted costs are predicted based on usage trends. For each threshold, you define one or more actions: email recipients (up to 50) or an action group. Action groups can send email, SMS, voice call, or trigger an automation runbook. For example, you might set an 80% actual threshold to notify the finance team, and a 100% forecasted threshold to trigger a runbook that scales down resources.
Review and create the budget
Before final creation, review the budget details: scope, amount, time period, thresholds, and actions. Ensure the email recipients are correct and the action group (if any) is properly configured. Once created, the budget becomes active immediately. The first evaluation occurs after the next cost data refresh (within a few hours). You can view the budget status in the Cost Management portal, showing current spend vs. budget, and any triggered alerts. You can also modify or delete the budget later. After creation, you can verify using CLI or PowerShell commands like `az consumption budget show`.
Monitor cost data and alerts
After the budget is active, Azure Cost Management continuously aggregates usage and billing data. Cost data is refreshed multiple times per day, typically every 4-8 hours, but can be delayed up to 48 hours. When actual or forecasted costs cross a threshold, an alert is generated. The alert is sent via email to the configured recipients and/or triggers the action group. In the portal, you can see alert history under the budget's 'Alert history' tab. You can also set up cost alerts separately (not as part of a budget) using Cost Alerts, but budget alerts are the primary mechanism for threshold-based notifications.
Respond to alerts and adjust budget
When you receive an alert, you should investigate the cost drivers. Use Cost Analysis to drill down into resources, services, or tags that are causing the spend. If the budget is too low, you can increase the budget amount. If you want to prevent further overspending, you can take manual actions (e.g., stop VMs) or use automation via action groups (e.g., run a runbook to delete unattached disks). You can also create multiple budgets for different scopes or time periods. Remember that budgets do not enforce limits; they only alert. For enforcement, you need Azure Policy or automation.
Enterprise Scenario 1: Multi-Subscription Governance
A large enterprise with 50+ subscriptions uses management groups to organize departments (e.g., Engineering, Marketing, Sales). They create a budget at the management group scope with a monthly limit of $100,000. They set thresholds at 80% (email to department heads), 100% (email to CFO and trigger a runbook that sends a Teams message), and 120% (trigger a runbook that disables creation of new resources via Azure Policy temporary deny assignment). The budget covers all subscriptions under that management group. They also create individual subscription budgets for critical workloads with lower thresholds. In production, they found that forecasted alerts are essential because they give 2-3 days' notice before actual costs hit the threshold. However, they had to adjust the threshold percentages because forecasted costs can be volatile; they now use 90% actual and 110% forecasted to avoid false positives. They also learned that budget alerts are not real-time; there is a 4-8 hour delay, so they supplement with custom alerts via Log Analytics for near real-time anomaly detection.
Enterprise Scenario 2: Automated Cost Remediation
A SaaS company runs a development environment that should not exceed $5,000 per month. They create a subscription-level budget with a threshold at 100% actual costs. The threshold triggers an action group that runs an Azure Automation runbook. The runbook stops all VMs with a 'Shutdown-On-Budget' tag. They also set a second threshold at 120% forecasted costs to send an email to the lead developer. In practice, the automation runbook must be carefully designed to avoid stopping production VMs; they use tags to differentiate. They also encountered a problem: the runbook could run multiple times if the alert fires repeatedly because cost data refreshes. They added a logic in the runbook to check if VMs are already stopped. Another issue: the runbook had permissions to stop VMs, but it needed Managed Identity with Contributor role on the subscription. They also set up a budget reset notification to remind the team to restart VMs at the beginning of the next month.
Common Misconfigurations and Pitfalls
Scope too broad: Setting budget at management group level may include unexpected subscriptions. Always verify the scope.
Thresholds too tight: Setting thresholds at 50% may cause alert fatigue. Use 80% and 100% as standard.
Forecasted alerts ignored: Many teams only set actual alerts, missing early warnings. Always add forecasted alerts.
Action group not tested: Action groups may fail if the runbook has errors or permissions are missing. Test with a sample alert.
Budget not updated: Budget amounts should be reviewed quarterly; static budgets may become irrelevant.
Performance and Scale Considerations
Budgets themselves have no performance impact. However, cost data aggregation can be resource-intensive for extremely large tenants with millions of resources. Azure Cost Management handles scale, but budget alerts may be delayed during peak data processing. The maximum of 100 budgets per scope is usually sufficient, but large enterprises may need to use management groups to aggregate. Action groups that trigger automation should be idempotent to avoid duplicate actions.
What AZ-104 Tests on This Topic (Objective 5.3)
The exam focuses on configuring and managing cost alerts and budget thresholds within Azure Cost Management. Specific sub-objectives include:
Create and manage budgets at various scopes (subscription, resource group, management group).
Configure alert thresholds based on percentage or amount, and distinguish between actual and forecasted costs.
Associate action groups with budget alerts for automated remediation.
Interpret cost data and respond to alerts.
Common Wrong Answers and Why Candidates Choose Them
"Budgets automatically block spending when exceeded." Candidates assume budgets work like spending caps. Reality: Budgets are alert-only; they do not enforce limits. Enforcement requires Azure Policy or automation.
"Alerts are triggered in real-time." Candidates expect immediate notification. Reality: Cost data refreshes multiple times a day, but up to 48-hour latency exists. Alerts are near real-time, not instant.
"You can set budgets at the resource level." Candidates think you can budget for a specific VM. Reality: Budgets are scoped to management group, subscription, resource group, or billing account. Resource-level filtering is possible via tags but not native.
"Forecasted alerts are based on actual costs." Candidates confuse forecasted with actual. Reality: Forecasted alerts use machine learning predictions; they can fire even if actual costs are below threshold.
Specific Numbers and Terms That Appear on the Exam
Maximum thresholds per budget: 10.
Maximum email recipients per alert: 50.
Maximum budgets per scope: 100.
Budget reset: Monthly on the 1st at midnight UTC.
Time grain options: Monthly, quarterly, annual.
Threshold types: Actual and Forecasted.
Alert actions: Email and Action group.
Cost data latency: Up to 48 hours.
Edge Cases and Exceptions the Exam Loves to Test
Multiple budgets on same scope: All budgets are evaluated independently. A single cost can trigger multiple alerts.
Budget with no end date: Not allowed; budgets must have an end date.
Deleting a budget: Deletes all associated alerts.
Action group failure: If the action group fails (e.g., runbook error), the alert is still generated but the action fails. The exam may ask what happens.
Overlapping budgets: If a resource group budget and a subscription budget both cover the same costs, both may alert.
How to Eliminate Wrong Answers Using the Underlying Mechanism
Understand that budgets are purely alerting mechanisms. They do not have any enforcement capability. If a question says "block spending" or "prevent deployment," the answer is not budget alone. Look for options that include Azure Policy, automation runbooks, or action groups. Also, remember that forecasted alerts are predictions, not actuals. If a question says "alert when costs are expected to exceed," the answer should involve forecasted thresholds. Finally, pay attention to scope: budgets cannot be set on individual resources. If an option says "budget for a specific VM," it's wrong unless using tags.
Budgets are alert-only; they do not block spending. Use action groups for automation.
You can set up to 10 thresholds per budget, each with separate actions.
Cost data can be up to 48 hours old; alerts are not real-time.
Forecasted alerts provide early warning based on predicted spending.
Budgets can be scoped to management group, subscription, resource group, or billing account.
Maximum of 100 budgets per scope.
Budget resets at the start of the time period (monthly on 1st, annually on start date).
Action groups can send email, SMS, voice call, or trigger automation runbooks.
You can have multiple budgets on the same scope.
Azure Policy can enforce budget creation across subscriptions.
These come up on the exam all the time. Here's how to tell them apart.
Budget Alert (Actual)
Triggers based on actual incurred costs.
Useful for knowing when you have already spent a certain amount.
Can be used for post-spending notification.
May have delay of up to 48 hours.
Best for tracking historical spend against budget.
Budget Alert (Forecasted)
Triggers based on predicted costs for the current period.
Useful for proactive notification before overspending.
Can fire even if actual costs are below threshold.
Provides early warning (days ahead).
Best for taking preventive action.
Mistake
Budgets can automatically stop resources when exceeded.
Correct
Budgets only send alerts. To stop resources, you must use an action group that triggers an automation runbook or another service. The budget itself has no enforcement capability.
Mistake
Cost alerts are triggered immediately when spending occurs.
Correct
Cost data is refreshed multiple times per day, but there can be up to 48 hours of latency. Alerts are based on the latest available data, so there is a delay.
Mistake
You can create a budget for a single Azure resource.
Correct
Budgets are scoped to management groups, subscriptions, resource groups, or billing accounts. You cannot create a budget directly for a VM or storage account. However, you can use tags to filter costs within a budget.
Mistake
Forecasted alerts are the same as actual cost alerts.
Correct
Forecasted alerts are based on predicted costs using machine learning, while actual alerts are based on incurred charges. They are separate threshold types and can be configured independently.
Mistake
A budget with a 100% threshold will alert exactly when you hit the limit.
Correct
Due to data latency, the alert may fire after you have already exceeded the limit. Also, the alert evaluates actual costs, so you might be over budget before the alert is sent.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, by associating an action group with the budget alert. The action group can include an Azure Automation runbook or a webhook that performs actions like stopping VMs. The budget itself does not perform actions; it only triggers the alert. You must ensure the runbook has appropriate permissions (e.g., Contributor role) to modify resources. Also, design the runbook to be idempotent to avoid issues if the alert fires multiple times.
Actual cost alerts trigger when the incurred spending reaches a threshold. Forecasted cost alerts trigger when the predicted spending for the period reaches a threshold. Forecasted alerts use machine learning based on historical usage to project future costs. They can provide early warning before you actually exceed the budget. You can configure both types on the same budget with different thresholds.
Budget alerts are evaluated each time the cost data is refreshed, which happens multiple times per day (typically every 4-8 hours). There is no configurable evaluation interval. Because cost data can be delayed up to 48 hours, alerts may not be in real-time. Microsoft recommends using forecasted alerts for earlier warnings.
Yes, you can set a budget at the resource group scope. This will track costs for all resources within that resource group. You cannot set a budget for an individual resource, but you can use tags to filter costs within a budget. For example, you can create a budget with a tag filter to track costs for resources tagged with 'Department: Marketing'.
Nothing automatically happens. Budgets are alert-only; they do not block spending or stop resources. You will receive alerts if you have configured thresholds. To enforce spending limits, you need to use Azure Policy (e.g., deny creation of expensive resources) or automation (e.g., a runbook that shuts down resources when a budget alert fires).
You can create up to 100 budgets per scope (e.g., per subscription). This is a soft limit that can be increased by requesting a quota increase. Each budget can have up to 10 thresholds. If you need more, consider using management groups to aggregate budgets.
Yes, by using an action group. Action groups support email, SMS, voice call, push notifications, and webhooks. When creating a budget alert, you can select an existing action group or create a new one. Note that SMS and voice calls have associated costs and may have regional limitations.
You've just covered Cost Alerts and Budget Thresholds — now see how well it sticks with free AZ-104 practice questions. Full explanations included, no account needed.
Done with this chapter?