Lesson 25 — Azure Cost Management & FinOps

Domain 1 — Identity & Governance AZ-104: 20–25% ~25 min

Why Cost Management Is an Admin Discipline

Cloud cost management is not the finance team's problem. It is an engineering discipline. Azure administrators are responsible for ensuring that resources are correctly sized, that idle resources are deleted, that committed use discounts are applied where they are cost-effective, and that spend is visible and attributed to the right teams.

For the AZ-104 exam, cost management appears in the governance domain. You will be tested on how budgets work, what Reserved Instances and Savings Plans are, what Azure Advisor recommends, and how tag-based cost allocation functions. In practice, these are decisions you make and defend every quarter.

Azure Cost Management + Billing

Azure Cost Management + Billing is the built-in portal tool for viewing, analysing, and managing cloud spend. It is available at Cost Management + Billing in the Azure portal, or by searching "Cost Management" in the portal search bar.

Access is scope-controlled — you can view costs at any scope where you have at least Reader access: Management Group, Subscription, or Resource Group level.

Cost analysis views

View What it shows When to use it
Accumulated cost Running total for the current period, showing spend to date and forecast to end of period Monthly budget tracking — are we on track to hit our budget?
Daily cost Cost broken down by day — each bar represents one day's spend Anomaly detection — spot a spike on a specific day and drill in
Cost by service Costs grouped by Azure service type (e.g. Virtual Machines, Storage, SQL Database) Understand which services are driving spend
Cost by resource Costs at the individual resource level — most granular view Identify the single most expensive resources; find unexpected costs

Group by and filter

Cost analysis supports flexible Group By and Filter dimensions:

  • Subscription, Resource Group, Resource, Resource Type
  • Service Name, Service Tier
  • Location (Azure region)
  • Tag — group costs by any tag key/value (e.g. group by CostCenter to see spend per department)
  • Meter, Meter Category

Forecast

Cost Management provides an ML-based forecast of month-end spend based on your usage patterns. The forecast is visible on the Accumulated cost view as a shaded projection beyond the current date. Forecasts are used in Budget alert conditions (see below).

Budgets and Alerts

Budgets are spending thresholds that trigger notifications when breached. They are a proactive governance control — not a technical enforcement mechanism.

Budget configuration

  • Scope: Management Group, Subscription, or Resource Group
  • Amount: Monthly, quarterly, or annual spend limit in your billing currency
  • Reset period: Monthly (most common), quarterly, or annually
  • Filters: Optionally scope the budget to specific resource groups, resource types, services, or tag values

Alert conditions

Each budget can have multiple alert conditions, each with a different threshold:

Alert Type Trigger Example
Actual cost When actual spend reaches X% of the budget amount Alert at 80% actual — "you have spent £800 of your £1,000 monthly budget"
Forecast cost When the ML forecast predicts end-of-period spend will reach X% of the budget Alert at 100% forecast — "you are predicted to spend £1,050 by month-end"

Alert recipients

Budget alert notifications can be sent to:

  • Email addresses (directly in the budget configuration)
  • Action Groups (which can trigger email, SMS, Teams, webhook, Azure Automation runbook, Logic App)
Critical — budgets do NOT stop or delete resources Budget alerts are notifications only. When a budget threshold is breached, Azure sends an alert — it does not pause VMs, delete resources, or stop any service. If you need automated action (e.g. shut down dev VMs when budget hits 100%), you must configure an Action Group that triggers an Azure Automation Runbook or Logic App to take the desired action. This is a very common exam trap.

Cost Allocation and Tag-Based Reporting

Without consistent tagging, you cannot split costs by team, project, or environment. Tags are the foundation of cost allocation in Azure Cost Management.

Once resources are tagged consistently (e.g. CostCenter: Engineering, CostCenter: Marketing, Environment: Production), Cost Management can group costs by tag value — giving you a chargeback or showback model for business units.

Tags on resource groups do NOT propagate to resources This is one of the most important operational facts about tags and a frequent exam trap. If you tag a Resource Group with CostCenter: Engineering, the resources inside it do NOT automatically inherit that tag. You must either: (a) tag every resource explicitly at deployment time, or (b) enforce tag inheritance via an Azure Policy using the built-in Inherit a tag from the resource group if missing definition with a Modify or Append effect. Without this policy, cost reporting by tag will have gaps.

Recommended mandatory tags for cost governance

  • CostCenter — billing code for the team/department owning the resource
  • Environment — Production, Staging, Development
  • Owner — email or team alias of the responsible party
  • Project — the workload or product this resource supports
  • ManagedBy — IaC tool used (e.g. Terraform, Bicep, Manual) for operational awareness

Enforce these tags at the Subscription or Resource Group scope via Azure Policy (Deny effect for missing tags, or Modify to append defaults). See Lesson 05 for full tagging policy patterns.

Azure Advisor Cost Recommendations

Azure Advisor continuously analyses your Azure usage and configuration and provides actionable recommendations across Reliability, Security, Performance, Cost, and Operational Excellence. The Cost category is directly relevant to cost management.

Azure Advisor's most impactful cost recommendations:

Recommendation What Advisor detects Action
Right-size underutilised VMs VMs with CPU utilisation below 5% average over 30 days Downsize to a smaller SKU or shut down if unused
Reserved Instance recommendations Analyses 30 days of usage and identifies workloads where RIs would save money Purchase RIs for consistently-running workloads — up to 72% savings
Delete idle resources Unattached managed disks, unused public IP addresses, empty load balancers Delete resources that are incurring costs without being used
Auto-shutdown for dev/test VMs VMs running 24/7 in non-production environments Enable auto-shutdown schedule (e.g. 7pm–7am) to eliminate overnight costs
SQL/storage right-sizing SQL databases with consistent low DTU utilisation; over-provisioned storage tiers Downsize to cheaper tier or SKU
Advisor uses 30-day actual usage patterns Advisor's RI recommendations are based on your actual usage — not theoretical workloads. If a VM has been running consistently for 30 days and you have no plans to change it, the RI recommendation is reliable. Review Advisor recommendations weekly as part of routine operations.

Reserved Instances (RI)

Azure Reserved Instances (also called Azure Reservations) allow you to pre-pay for one or three years of a specific resource type in exchange for a significant discount over pay-as-you-go pricing.

Key RI parameters

  • Term: 1 year or 3 years (3-year gives higher discount)
  • Scope:
    • Single subscription — discount applies only to matching VMs in one subscription
    • Shared — discount pools across all subscriptions in the billing account/EA enrollment; most efficient for enterprises
    • Management group — discount applies across subscriptions in the selected management group
  • Payment: All upfront (maximum discount), partial upfront, or monthly (no extra interest, but lowest discount)
  • Discount level: Up to 72% off pay-as-you-go for VMs; up to 65% for SQL; up to 80% for Cosmos DB

Instance Size Flexibility

For many VM families, RIs support Instance Size Flexibility — the reservation discount automatically applies to any VM size within the same series family and region. For example, a D4s_v3 RI can partially cover a D8s_v3 (using two RI units) or fully cover two D2s_v3 VMs.

Exchange and refund

  • Exchange: You can exchange a reservation for a different size, region, or service type (within the same product family) without financial penalty — as long as you simultaneously purchase a new reservation of equal or greater value.
  • Refund: You can cancel a reservation for a pro-rated refund. Total refund limit is $50,000 per 12-month rolling window. A 12% early termination fee applies.

Azure Savings Plans

Azure Savings Plans provide a more flexible committed-use discount than Reserved Instances. Instead of committing to a specific VM size and region, you commit to a fixed hourly compute spend (e.g. $10/hour) and the discount applies automatically to any eligible compute usage — regardless of VM size, series, or region.

Savings Plan eligible compute

  • Virtual Machines (all series, all regions)
  • Azure Container Apps (consumption plan)
  • Azure App Service (Premium v2 and v3)
  • Azure Functions (dedicated and Premium plans)
  • Azure Dedicated Host

Comparing RIs and Savings Plans

Feature Reserved Instances Savings Plans
Commitment Specific VM size + region + OS Fixed hourly spend ($ / hour)
Flexibility Low — tied to specific configuration (with instance size flexibility within family) High — applies to any eligible compute across all sizes and regions
Maximum discount Up to 72% (3-year, all upfront) Up to 65% (3-year, all upfront) — lower for equivalent term
Best for Stable, predictable workloads — same VM size running 24/7 with no planned changes Variable or unpredictable compute mix — workloads that change size, region, or type over time
Coverage Specific resource type only (VMs, SQL, Cosmos, etc.) Compute-only, but spans VM families and compute services automatically
Term 1 or 3 years 1 or 3 years
Exchange / refund Yes — exchange allowed, refund with 12% fee up to $50k/year No exchange (trade-in for new plan only); refund with 12% fee up to $50k/year
Decision rule If your workload is stable and you know it will run on the same VM SKU and region for 1–3 years: choose a Reserved Instance (higher discount). If your compute mix is dynamic — different sizes, regions, or service types — choose a Savings Plan (more flexibility, slightly lower discount ceiling).

Azure Hybrid Benefit

Azure Hybrid Benefit allows you to bring existing on-premises licences with Software Assurance to Azure, eliminating the licence cost component from the Azure VM price.

Licence Type What's covered Maximum savings
Windows Server Bring your own Windows Server licence with Software Assurance — the Windows OS licence charge is removed from the VM hourly rate Up to 49% off pay-as-you-go
SQL Server Bring your own SQL Server licence for Azure SQL Database, SQL Managed Instance, or SQL Server on VMs Up to 85% off pay-as-you-go
Red Hat Enterprise Linux (RHEL) Bring your own RHEL subscription Replaces PAYG RHEL subscription cost
SUSE Linux Enterprise Bring your own SUSE subscription Replaces PAYG SUSE subscription cost

Enabling Hybrid Benefit

Enable Hybrid Benefit per-VM in the portal (VM → Configuration blade → Azure Hybrid Benefit checkbox), or at scale using Azure Policy with the Configure Azure Hybrid Benefit for Windows Server VM built-in initiative. Enabling at scale is strongly recommended for enterprises with large Windows Server fleets — manual per-VM enablement is error-prone and commonly missed on new deployments.

Stacking discounts You can combine Azure Hybrid Benefit + Reserved Instances for maximum savings. A Windows Server VM with both a 3-year RI and Hybrid Benefit applied can save up to 82% compared to pay-as-you-go without Hybrid Benefit. This is the maximum discount achievable for a standard Windows VM workload.

Dev/Test Pricing

Azure subscriptions configured as Dev/Test subscriptions receive discounted pricing specifically for development and test workloads:

  • Windows Server VMs: No Windows licence charge — same discount effect as Hybrid Benefit for Windows
  • SQL Server: Discounted SQL pricing
  • Logic Apps, App Service, API Management: Dev/Test pricing tiers

Important constraint: Dev/Test pricing subscriptions must not be used for production workloads. This is a licensing agreement condition. Using Dev/Test pricing for production is a licence violation with financial and legal exposure.

Dev/Test subscriptions are available under Visual Studio subscriptions (MSDN) and as EA Dev/Test subscription offers. They are ideal for CI/CD environments, developer workstations, staging, and test environments.

FinOps Principles — Cloud Financial Management

FinOps (Cloud Financial Management) is the practice of bringing financial accountability to cloud spend. It is a cultural shift as much as a technical one — moving from centralised cost control to distributed team ownership within a governance framework.

The FinOps Foundation defines three core activities:

Activity Description Azure tools
Inform Visibility — everyone can see their spend. Teams cannot manage what they cannot see. Azure Cost Management, tag-based cost allocation, exported cost data to Storage or Power BI
Optimize Reduce waste — right-sizing, committed use discounts, idle resource cleanup, architecture efficiency Azure Advisor, Reserved Instances, Savings Plans, Hybrid Benefit, auto-shutdown, spot VMs
Operate Accountability — engineering teams own their budgets. FinOps team provides tooling, reporting, and guidance. Budget alerts, subscription-level RBAC for cost visibility, monthly cost reviews, chargeback reporting
FinOps is not cost-cutting The goal of FinOps is to maximise business value from cloud spend — not to minimise spend at all costs. Sometimes the right answer is to spend more (e.g. add redundancy for a critical service) while eliminating waste elsewhere. The discipline is about intentional, data-driven spending decisions — not arbitrary budget cuts.

Enterprise Cost Management Best Practices

Cost management checklist for enterprise admins Use this as a recurring operational checklist:
  • Enable budgets on every subscription with alerts at 80% and 100% actuals, plus a 100% forecast alert
  • Enforce mandatory CostCenter, Owner, and Environment tags via Azure Policy (Deny on missing tags at subscription creation)
  • Review Azure Advisor cost recommendations weekly — prioritise RI recommendations and idle resource cleanup
  • Set up a monthly cost review cadence with engineering team leads — walk through Cost Analysis grouped by CostCenter tag
  • Use Shared scope for Reserved Instances across an Enterprise Agreement — maximises RI utilisation
  • Enable Azure Hybrid Benefit at scale via Azure Policy for all Windows Server and SQL Server VMs
  • Configure auto-shutdown schedules for all VMs in Dev/Test subscriptions
  • Export cost data to a Storage Account or Log Analytics workspace for long-term trend analysis and Power BI dashboards
  • Review policy exemptions quarterly — revoke any that have expired or lack business justification

Check Your Understanding

Click any option to see immediate feedback.

1. You configure a budget on a subscription with an alert at 100% of the monthly budget amount. When the alert fires, what happens to the running resources in that subscription?

Budget alerts only send notifications — they do NOT automatically pause, stop, or delete resources. To automatically act on a budget alert, you must configure an Action Group that triggers an Azure Automation Runbook or Logic App to take the desired action. This is one of the most commonly tested Cost Management facts in AZ-104.

2. Your Azure Advisor Cost dashboard shows a recommendation to purchase Reserved Instances for several virtual machines. On what basis does Advisor generate this recommendation?

Azure Advisor analyses your actual usage patterns over 30 days and recommends Reserved Instances based on what you've been consistently running. Implementing these recommendations for stable, always-on workloads can save up to 72% over pay-as-you-go. The recommendation is data-driven, not generic.

3. You tag a Resource Group with CostCenter: Engineering and then deploy ten virtual machines into it. When you run a Cost Analysis grouped by the CostCenter tag, the VMs do not appear under the Engineering cost centre. Why?

Tags on Resource Groups do NOT automatically propagate to resources inside them. Consistent tag-based cost allocation requires an Azure Policy with a Modify or Append effect to enforce tag inheritance (e.g. the built-in "Inherit a tag from the resource group if missing" policy). Without this policy, resources lack the tags needed for cost split reporting.

4. You purchase a Shared scope Reserved Instance for 10 D4s_v3 VMs. At any given hour, Subscription A is running 6 D4s_v3 VMs and Subscription B is running 8 D4s_v3 VMs. How is the RI discount applied?

Shared scope Reserved Instances apply the discount across all subscriptions in the billing account/enrollment. In this case, 10 RI units cover 6 VMs in Subscription A and 4 VMs in Subscription B. The remaining 4 VMs in Subscription B are billed at pay-as-you-go. Shared scope maximises RI utilisation across an enterprise with multiple subscriptions.

5. A workload runs on VMs that change size and region monthly based on demand. Which committed-use discount is most appropriate?

Azure Savings Plans commit to a fixed hourly spend on compute and automatically apply the discount to any eligible compute type — VMs (any size, any region), Container Apps, App Service Premium. Unlike RIs, they are not locked to a specific VM size or region, making them ideal for variable workload mixes. Instance Size Flexibility on RIs is limited to within the same VM series family, not across series or regions.

6. Your organisation runs 200 Windows Server VMs in Azure on pay-as-you-go pricing. The VMs have been deployed without Azure Hybrid Benefit despite the organisation having active Software Assurance licences. What is the most cost-effective way to enable Hybrid Benefit across all 200 VMs?

Azure Hybrid Benefit can be enabled on existing running VMs without redeployment — it modifies the licence type property, not the VM itself. The most scalable approach is an Azure Policy using the built-in "Configure Azure Hybrid Benefit for Windows Server VM" initiative, which applies Hybrid Benefit to all existing and future VMs at the assigned scope. Combined with Reserved Instances, this can reduce Windows VM costs by up to 82%.
Course Complete — You are ready for AZ-104 You have completed all 25 lessons of this Azure Administration course. You have covered identity and governance (Entra ID, RBAC, Azure Policy, Management Groups), core compute and storage services (VMs, VMSS, App Service, Storage Accounts), networking (VNets, NSGs, Load Balancers, VPN/ExpressRoute), monitoring and operations (Azure Monitor, Log Analytics, Backup, Site Recovery, Network Watcher), and now cost governance and FinOps. You have the conceptual depth, the operational patterns, and the exam preparation to sit the AZ-104 certification. Review any lessons where your quiz scores were below 4/6, revisit the primary source links for those areas, and go build. Good luck.
Primary source for this lesson Azure Cost Management + Billing Documentation — Microsoft Learn

Read the cost analysis quickstart, the budgets tutorial, and the Reserved Instances vs Savings Plans comparison article. For FinOps, also read the FinOps Foundation's Cloud FinOps framework at finops.org.

Questions for your teacher (the AI agent)
This lesson covered the core tools for cost governance. Go deeper with these:
  • Walk me through designing a chargeback model for a company with 5 business units sharing 30 Azure subscriptions — how would you structure tags, policies, and Cost Management exports?
  • What is the difference between chargeback and showback in FinOps, and which is appropriate for a company at the beginning of their cloud adoption journey?
  • When should I choose a 1-year vs 3-year Reserved Instance, and how do I calculate the break-even point for each payment option?
  • How do I use Azure Cost Management exports with Power BI to build an executive cost dashboard for leadership?