How to Detect Cost Anomalies in Azure and Google Cloud
Azure and Google Cloud each ship a native anomaly detector with different scopes, delays and alert limits. Here is how to switch both on.
Both providers include a native anomaly detector, but they behave differently enough that an alert from one is not comparable with an alert from the other. This guide enables each, then explains what a detection actually means. For AWS, see AWS Cost Anomaly Detection alerts.
Azure: create an anomaly alert rule
Access: Owner, Contributor or Cost Management Contributor on the subscription. Anomaly alert rules exist only at subscription scope, and only in the Azure public cloud (not Azure Government or sovereign clouds).
- From Azure Home, open Cost Management under Tools.
- Check that the scope at the top of the page is the subscription you want.
- In the left menu select Cost alerts, then + Add.
- On Create alert rule, choose Anomaly as the Alert type, fill in the recipients and select Create.
- The rule is listed under Alert rules.
A subscription allows five anomaly alert rules; add yourself as a recipient on an existing rule rather than creating a sixth. To script it, the Cost Management Scheduled Actions API creates the same rule with the scheduled action kind InsightAlert.
How Azure detects: each subscription is evaluated daily, comparing the day’s total against a forecast built from the previous 60 days, so recurring patterns such as a Monday spike are learned. Detection runs 36 hours after the end of the UTC day. The alert email is sent once, at detection. To check what was found without waiting for mail, open Cost analysis, pick any view under Smart views at subscription scope, and read the Insights panel: it shows either the anomaly or “No anomalies detected” with the dates evaluated.
Google Cloud: use the Anomalies dashboard
Access: on the Cloud Billing account, Billing Account Costs Manager or Billing Account Administrator to manage anomalies (Billing Account Viewer to view). Pub/Sub notifications additionally need Pub/Sub Admin on the project holding the topic.
- In the console go to Billing › Anomalies.
- Choose the billing account, then Go to Anomalies.
- Set the thresholds for cost impact amount and percent deviation so the list shows what you care about.
- Configure alerts and notifications from the same dashboard, optionally to a Pub/Sub topic.
- Give feedback on detections you consider wrong, which Google uses to improve accuracy.
Users with project-scoped billing access see anomalies one project at a time through the project selector. Google’s standard anomalies are measured on usage cost at on-demand rates, before most credits; AI workloads such as Gemini API and Vertex AI can also show early anomalies from near-real-time estimates.
Reading the two side by side
| Azure | Google Cloud | |
|---|---|---|
| Scope | Subscription | Billing account or project |
| Timing | Daily, 36 hours after day end | Standard anomalies, plus early anomalies for AI workloads |
| Baseline | 60-day forecast | Usage cost at on-demand rates |
| Limits | 5 alert rules per subscription | View thresholds for impact and percent deviation |
Neither detector stops anything. Treat an alert as the start of an investigation: find the resource, then the change (a resize, a new resource, an expired commitment).
One detector across all clouds
ZopNight evaluates anomalies daily across seven dimensions: org, cloud account, resource type, resource group, resource, team, and the Azure resource group and tenant hierarchy. It runs percent deviation against a 7-day rolling average and a z-score, keeps the higher severity (warning from 30%, critical from 100%, emergency from 500%), and skips series with fewer than four data points, under a dollar a day, or with very low variance. Each anomaly carries a root cause: an instance resize, a new resource, a reservation or savings plan expiring, a schedule failure, or unscheduled usage growth. Background on tuning is in the anomaly detection guide.