Threshold-crossing notifications

Outcome

By the end of this lesson, you will be able to pick a budget’s alert threshold, route its warning and exceeded alerts to the right audience, and predict how often each channel will hear about it.


Prerequisites	M4.6.L1 (budget basics) · M4.6.L2 (budget scopes)
Time	9 minutes

1. Concept

A ZopNight budget raises two alerts, never more.

The warning fires when month-to-date spend reaches the alert threshold you set on the budget (any whole percentage from 1 to 100; 0 turns it off). The exceeded alert fires at 100% of the monthly amount and cannot be turned off. Escalation is not built from more markers; it is built from two levels and the channels you send each one to.

BUDGET: $4,800/month (resource group dev-platform-eu)
ALERT THRESHOLD: 75%

  budget.warning   ($3,600):  #dev-platform-eu          (team awareness)
  budget.exceeded  ($4,800):  #dev-platform-eu +
                              #finops-alerts             (overage)

The first level tells the team; the second brings in FinOps. That is the whole chain, and for most budgets it is enough: one early conversation and one decision point.

Picking the threshold

The threshold is the one design choice per budget. Lower means earlier warning and a longer stretch of the month in yellow; higher means less noise and less time to react.

BUDGET KIND                 THRESHOLD   REASON
──────────────────────────────────────────────────────────────────
Dev / test group            85-90%      Variance is tolerable; warn
                                        only when close
Prod-critical resource      70-75%      Production cost anomalies
or group                                grow fast; want time to act
Small budget ($100/month)   0 (off)     Variance is normal; the
                                        exceeded alert is enough
Whole cloud account         80%         Broad scope; a warning
                                        should mean something

A threshold of 50% is rarely useful on a monthly budget: spend reaches 50% around mid-month in a normal month, so the budget sits in yellow, and channels keep hearing about it, for half of every month.

How often a channel hears about it

Alerts come from the daily cost job, not from a live trigger. What happens on each run depends on whether a channel is subscribed:

CHANNEL SUBSCRIBED (Slack, Microsoft Teams, Google Chat, webhook):
  2026-05-18: spend reaches 76% → budget.warning posted
  2026-05-19: still above 75%   → budget.warning posted again
  ...         every daily run while the level holds
  2026-05-26: spend reaches 100% → budget.exceeded posted
  2026-05-27: still over         → budget.exceeded posted again

NO CHANNEL SUBSCRIBED (email fallback to org admins):
  2026-05-18: warning email (first warning this month)
  2026-05-19: nothing (same level)
  2026-05-26: exceeded email (level went up)
  2026-05-27: nothing (same level)

NEXT MONTH:
  2026-06-01: each month is its own budget; the first crossing
              in June sends again

The daily repeat on channels is deliberate: a chat card costs a glance. The email fallback sends once per level per month so admins do not learn to filter it. Plan for the repeat: a channel that receives exceeded alerts will hear about an over-budget budget every day until month-end.

Routing: org-wide and per-budget

Routing is a notification subscription: a channel, an event (budget.warning or budget.exceeded), and a scope.

ORG-WIDE (Settings → Notifications → Channels & Alerts)
  Tick Budget Warning and Budget Exceeded per channel.
  Applies to every budget in the org.
  Good for: one FinOps channel that sees everything.

SCOPED (API or the create_notification_subscription MCP tool)
  Scope the subscription to a resource, a resource group or a
  cloud account. Only alerts from budgets on that target go to
  that channel.
  Good for: sending dev-platform-eu's alerts to #dev-platform-eu
            and nowhere else.

AI provider budgets raise their own event family (budget.ai_gateway.warning and budget.ai_gateway.critical), so they can be routed separately from cloud budgets.

To widen the audience at 100%, add a subscription for budget.exceeded on another channel. You do not need a second threshold to reach a second audience.

What happens after 100%

At 100%: the exceeded alert fires; the budget is at commitment level
After 100%: spend continues normally (budgets don't auto-stop)

POSSIBLE RESPONSES (human-mediated):
  1. INVESTIGATE: find the source of the overrun
  2. ADJUST BUDGET: edit the amount, once or for good
  3. CORRECTIVE ACTION: kill / scale-down resources
  4. ACCEPT: document the overrun and move on
  5. ESCALATE: bring to leadership / finance

ZopNight cannot enforce a budget without risking production damage. The exceeded alert is the conversation trigger; the response is the conversation.

Common configuration mistakes

MISTAKE                          IMPACT             FIX
──────────────────────────────────────────────────────────────────
Threshold 0 on a prod budget     Only the 100%      Set 70-75%
                                 alert; no early
                                 signal

Threshold 50% on a monthly       Yellow half the    Raise to 75-90%
budget                           month; daily
                                 channel noise

Both events to one busy          Daily repeats      Warning to the team;
org-wide channel                 drown the channel  exceeded to team +
                                                    FinOps

Every budget org-wide to the     Team hears about   Scope subscriptions
team channel                     other teams'       to the team's groups
                                 budgets            or resources

No channel subscribed at all     Admins get one     Subscribe the owning
                                 email; the team    team's channel
                                 never hears

The most common mistake is the first: leaving the threshold at 0. By the time the exceeded alert starts the conversation, the month is mostly spent; there is little time to adjust.

How ZopNight sends budget alerts

Channels can be Slack, Microsoft Teams, Google Chat or a generic webhook (point it at your own on-call tool if you want paging). Email goes only to org admins, and only when no channel is subscribed. There is no time-of-day routing and no acknowledgement tracking: track who picked up an alert in the channel thread or your ticket.

Budget alerts are not audit log entries. The audit log (M4.3) records API changes, such as someone editing a budget’s amount or threshold, not the alerts themselves.

2. Demo

A real escalation through a month:

BUDGET:  dev-platform-eu group, $4,800/month
ALERT THRESHOLD: 75%
ROUTING: warning  → #dev-platform-eu (scoped to the group)
         exceeded → #dev-platform-eu + #finops-alerts (both scoped)

DAY 18
  Spend reaches $3,620 (75.4%); status turns yellow
  Daily run: budget.warning posted to #dev-platform-eu
  Team lead asks: "anything unusual happening?"
  Engineer: "we provisioned 2 test instances yesterday for
             a load test"

DAY 19-25
  Spend between 75% and 100%
  budget.warning posted again on each daily run
  FinOps is not involved yet; the team owns the decision:
  accept the test-instance cost, clean up after the load test

DAY 26
  Spend reaches $4,810 (100.2%); status turns red
  Daily run: budget.exceeded posted to #dev-platform-eu and
             #finops-alerts
  Variance conversation (30 minutes):
    Cause: load-test instances (already known)
    Impact: about $30 over budget at month-end
    Decision: accept (load test successful; instances will be
              cleaned up on schedule)

DAY 27-31
  budget.exceeded posted daily; both channels already know

END OF MONTH
  Spend: $4,830 (100.6%); minimal overage
  Action: documented; June amount unchanged
  Lesson: include planned load tests in budget planning

Two levels, two audiences. The team heard first and had a week to decide; FinOps heard only when the commitment was reached.

3. Hands-on (5 min)

For one of your team’s budgets, audit the alert setup:

BUDGET:               __________
AMOUNT:                $__________ /month
TARGET:               resource / group / cloud account / AI provider

ALERT THRESHOLD:      _____ %  (0 = off)

ROUTING:
  budget.warning  → channel: __________ (org-wide or scoped?)
  budget.exceeded → channel: __________ (org-wide or scoped?)
  No channel? → admins get email only

GAPS:
  □ Threshold 0 on a budget that matters (no early warning)
  □ Threshold so low the budget is yellow half the month
  □ Both levels → same busy channel (daily-repeat noise)
  □ Team channel gets every budget in the org (not scoped)
  □ No channel subscribed at all

PROPOSED IMPROVEMENT:
  __________________________________________________________

If your threshold is 0, you have no early warning. Set one, and route the warning to the owning team’s channel.

4. Knowledge check

Q1

A budget crosses its 90% alert threshold. What happens to spending?

A. A hard stop, blocking any new resources
B. The resources are all auto-disabled
C. Notification fires; spending continues
D. Provisioning is blocked until reset

Show answer

Correct: C. Budgets are conversation triggers, not enforcement. The warning means “talk about this now, before the 100% overage.” The notification triggers the conversation; the conversation drives action.

Q2

A Slack channel subscribes to budget.exceeded. A budget goes over 100% on the 20th and stays over. How often does that channel hear about it?

A. Once, on the 20th, and never again that month
B. On every daily cost run while it stays over
C. Once a week, on Mondays, until month-end
D. Only again if spend later passes 110%

Show answer

Correct: B. Alerts come from the daily cost job, and a subscribed channel gets the alert on every run while the level holds. Only the email fallback (no channel subscribed) sends once per level per month. There is no 110% level: a budget has a warning threshold and a fixed exceeded alert at 100%.

Q3

A production budget is at 110% with ten days left in the month. Best response:

A. Wait until next week
B. Note it and review at the end of the period
C. Treat it as an emergency
D. Mute alerts; wait it out

Show answer

Correct: C. 110% on production with a third of the month left is a real deviation that needs investigation now: runaway cost, schedule failure, security incident, or unplanned launch. The exceeded alert has been firing for days already; the response should match the business impact.

5. Apply

Set each budget’s alert threshold on the Budgets page. Route the alerts in Settings → Notifications, Channels & Alerts tab (org-wide), or with a scoped subscription through the API or MCP when one budget’s alerts should reach one team only.

For org-wide consistency, document your threshold convention (which percentage for which kind of budget, which channel gets which level) in your team wiki: different teams using different conventions makes cross-team variance review harder than it needs to be.

Glossary terms touched

Notification channel · Alert fatigue

Outcome

1. Concept

Picking the threshold

How often a channel hears about it

Routing: org-wide and per-budget

What happens after 100%

Common configuration mistakes

How ZopNight sends budget alerts

2. Demo

3. Hands-on (5 min)

4. Knowledge check

Q1

Q2

Q3

5. Apply

Related lessons

Glossary terms touched

Start with the bill.