Cost Management Guide

// Deny resource group creation without required tags
resource requireTagPolicy 'Microsoft.Authorization/policyDefinitions@2021-06-01' = {
  name: 'require-cost-center-tag'
  properties: {
    displayName: 'Require cost-center tag on resource groups'
    description: 'Denies creation of resource groups without a cost-center tag'
    policyType: 'Custom'
    mode: 'All'
    policyRule: {
      if: {
        allOf: [
          {
            field: 'type'
            equals: 'Microsoft.Resources/subscriptions/resourceGroups'
          }
          {
            field: 'tags[cost-center]'
            exists: 'false'
          }
        ]
      }
      then: {
        effect: 'deny'
      }
    }
  }
}

// Auto-inherit tags from resource group to child resources
resource inheritTagPolicy 'Microsoft.Authorization/policyDefinitions@2021-06-01' = {
  name: 'inherit-cost-center-tag'
  properties: {
    displayName: 'Inherit cost-center tag from resource group'
    policyType: 'Custom'
    mode: 'Indexed'
    policyRule: {
      if: {
        allOf: [
          {
            field: 'tags[cost-center]'
            exists: 'false'
          }
          {
            value: '[resourceGroup().tags[\'cost-center\']]'
            notEquals: ''
          }
        ]
      }
      then: {
        effect: 'modify'
        details: {
          roleDefinitionIds: [
            '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
          ]
          operations: [
            {
              operation: 'addOrReplace'
              field: 'tags[cost-center]'
              value: '[resourceGroup().tags[\'cost-center\']]'
            }
          ]
        }
      }
    }
  }
}

# Create a monthly budget with alerts at 50%, 80%, 100%, and 120% (forecast)
az consumption budget create \
  --budget-name "production-monthly" \
  --amount 10000 \
  --category Cost \
  --time-grain Monthly \
  --start-date 2025-01-01 \
  --end-date 2026-12-31 \
  --resource-group production-rg \
  --notifications '{
    "50-percent": {
      "enabled": true,
      "operator": "GreaterThanOrEqualTo",
      "threshold": 50,
      "contactEmails": ["finops@company.com"],
      "thresholdType": "Actual"
    },
    "80-percent": {
      "enabled": true,
      "operator": "GreaterThanOrEqualTo",
      "threshold": 80,
      "contactEmails": ["finops@company.com", "team-lead@company.com"],
      "thresholdType": "Actual"
    },
    "100-actual": {
      "enabled": true,
      "operator": "GreaterThanOrEqualTo",
      "threshold": 100,
      "contactEmails": ["finops@company.com", "team-lead@company.com", "vp-eng@company.com"],
      "thresholdType": "Actual"
    },
    "120-forecast": {
      "enabled": true,
      "operator": "GreaterThanOrEqualTo",
      "threshold": 120,
      "contactEmails": ["finops@company.com", "vp-eng@company.com", "cto@company.com"],
      "thresholdType": "Forecasted"
    }
  }'

# List existing budgets
az consumption budget list --output table

# Create an action group for automated cost response
az monitor action-group create \
  --name cost-alert-actions \
  --resource-group monitoring-rg \
  --action webhook cost-webhook "https://automation.company.com/cost-alert"

# Get reservation purchase recommendations from Azure Advisor
az advisor recommendation list \
  --category Cost \
  --query "[?shortDescription.solution=='Buy reserved virtual machine instances']" \
  --output table

# Check current reservation utilization (are existing RIs being used?)
az consumption reservation summary list \
  --reservation-order-id <order-id> \
  --grain monthly \
  --output table

# View reservation recommendations via REST API
az rest --method GET \
  --uri "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.Consumption/reservationRecommendations?api-version=2023-05-01&$filter=properties/scope eq 'Shared' AND properties/lookBackPeriod eq 'Last30Days' AND properties/term eq 'P3Y'" \
  --query "value[].{SKU:properties.skuProperties[0].value, Savings:properties.netSavings, Cost:properties.totalCostWithReservedInstances}"

# Calculate potential savings plan benefit
az rest --method GET \
  --uri "https://management.azure.com/subscriptions/<sub-id>/providers/Microsoft.BillingBenefits/savingsPlanRecommendations?api-version=2022-11-01&$filter=properties/term eq 'P3Y' AND properties/lookBackPeriod eq 'Last30Days'"

# Find unattached managed disks
az disk list \
  --query "[?managedBy==null].{Name:name, RG:resourceGroup, SizeGB:diskSizeGb, SKU:sku.name}" \
  --output table

# Find unused public IPs (not associated with any NIC)
az network public-ip list \
  --query "[?ipConfiguration==null].{Name:name, RG:resourceGroup, Address:ipAddress}" \
  --output table

# Find empty App Service plans (no apps deployed)
az appservice plan list \
  --query "[?numberOfSites==`0`].{Name:name, RG:resourceGroup, SKU:sku.name, Workers:sku.capacity}" \
  --output table

# Find stopped VMs (still billing for disk and IP)
az vm list -d \
  --query "[?powerState!='VM running'].{Name:name, RG:resourceGroup, Size:hardwareProfile.vmSize, State:powerState}" \
  --output table

# Find idle load balancers (no backend pool members)
az network lb list \
  --query "[?length(backendAddressPools)==`0` || backendAddressPools[0].backendIPConfigurations==null].{Name:name, RG:resourceGroup}" \
  --output table

# Get comprehensive Advisor cost recommendations
az advisor recommendation list --category Cost --output table

# Find resources without required tags (potential orphans)
az resource list \
  --query "[?tags.owner==null].{Name:name, Type:type, RG:resourceGroup}" \
  --output table | head -50

# Enable auto-shutdown on a VM (deallocates at specified time)
az vm auto-shutdown \
  --resource-group dev-rg \
  --name dev-vm-01 \
  --time 1900 \
  --timezone "Eastern Standard Time"

# Create an Automation Account for scheduled start/stop
az automation account create \
  --name cost-automation \
  --resource-group automation-rg \
  --location eastus2

# Apply Hybrid Benefit to existing Windows VMs
az vm update \
  --resource-group myRG \
  --name myWindowsVM \
  --license-type Windows_Server

# Apply Hybrid Benefit to SQL Server VMs
az vm update \
  --resource-group myRG \
  --name mySqlVM \
  --license-type RHEL_BYOS

# Bulk-check Hybrid Benefit status across subscription
az vm list \
  --query "[?storageProfile.osDisk.osType=='Windows'].{Name:name, RG:resourceGroup, Size:hardwareProfile.vmSize, License:licenseType}" \
  --output table

# Create a scheduled cost export (daily to storage account)
az costmanagement export create \
  --name daily-cost-export \
  --scope /subscriptions/<sub-id> \
  --type ActualCost \
  --storage-account-id /subscriptions/<sub-id>/resourceGroups/finops-rg/providers/Microsoft.Storage/storageAccounts/costexportstorage \
  --storage-container cost-data \
  --timeframe MonthToDate \
  --recurrence Daily \
  --recurrence-period from="2025-01-01" to="2026-12-31" \
  --schedule-status Active

# Query current month cost by service
az costmanagement query \
  --type ActualCost \
  --scope /subscriptions/<sub-id> \
  --timeframe MonthToDate \
  --dataset-aggregation '{"totalCost":{"name":"Cost","function":"Sum"}}' \
  --dataset-grouping '[{"type":"Dimension","name":"ServiceName"}]'

# Enable cost anomaly alerts
az costmanagement alert list \
  --scope /subscriptions/<sub-id> \
  --output table