Automatic anomaly detection

Overview

Automatic anomaly detection gives you real-time visibility into unusual Azure cost spikes within a cost management group. It uses your historical spend data to identify cost changes that fall outside a normal pattern, at daily intervals, and alerts you the moment one is detected.

Business value

Anomaly detection removes the need to manually scan cost reports for unexpected spikes. By flagging only statistically significant cost changes, it lets your team react to genuine cost risks faster, without being buried in noise from normal day-to-day fluctuations.

Prerequisites

Anomaly detection is enabled by default when a cost management group is created. No separate setup is required before configuring it.

Required permissions

The Monitoring toggle must be enabled for the role before users can access anomaly detection. To enable the toggle, an administrator must edit the role in role management.

For Explain with AI access, users also require the AI Agents feature to be enabled for their role, in addition to Monitoring access.

How it works

Anomaly detection runs at the group level, monitoring subscription costs at the daily interval, using statistical analysis rather than fixed dollar thresholds.

Standard deviation: the basis of detection

Standard deviation measures how much daily cost changes normally vary. A low standard deviation means costs move in small, steady increments; a high standard deviation means costs swing widely. It answers one question: what counts as a normal amount of fluctuation? Only cost changes that fall well outside that normal range are flagged; everyday noise is ignored.

Detection algorithm

1. Collect the last 30 days of daily cost data and calculate each day's cost change: CostChange[day] = Cost[day] - Cost[day-1].
2. Compute the standard deviation of those 30 daily changes. This is the baseline for "normal" movement.
3. Calculate today's cost change: TodayChange = Cost[today] - Cost[yesterday].
4. Flag an anomaly when: abs(TodayChange) > (StandardDeviation x ThresholdMultiplier).

Once an anomaly is identified, Turbo360 inspects the service-level costs within the monitored scope to surface the resources most likely responsible for the spike. When an anomaly is detected, an alert is sent through your configured notification channels and logged as an incident.

Threshold multiplier and sensitivity

The Threshold multiplier scales the standard deviation to set how large a cost change must be before it's flagged. Lower multipliers (1.0-1.5) are more sensitive and surface more alerts, useful for early warning. Higher multipliers (2.0-3.0) are less sensitive and only flag larger spikes.

AI classification and severity

After an anomaly is flagged, Turbo360 uses AI to assess whether it's a genuine cost anomaly or a false positive, and assigns it a severity.

• AI classification: each anomaly is evaluated as Verified by AI (the AI confirms it's genuine) or Not verified by AI (the AI judges it a likely false positive).
• Severity: each anomaly is assigned one of four severities: Info, Warning, Issue, or Critical.
• Send alerts only for anomalies classified as true by AI: when this option is enabled, only AI-verified anomalies are recorded and sent to notification channels. When disabled, both AI-verified and AI-classified false anomalies are recorded and sent to configured channels.
• Minimum cost change to alert on: an anomaly triggers an alert only if its cost change exceeds this amount, in the group's billing currency. Changes at or below this value are not alerted, and the AI also treats them as low relevance. Leave this blank for no floor.

Notification channels can further filter which of these anomalies they receive, based on severity and AI classification. See Steps and Configuration below.

Explain with AI

Explain with AI generates a structured, AI-driven audit of a cost management group's anomaly detection setup, covering the current configuration, cost consistency, recent anomaly history, severity distribution, alert routing, and tuning recommendations. The Anomaly Insights panel turns raw anomaly detection settings and alert history into a ready-made audit, saving teams from manually correlating threshold settings, cost volatility, and alert history to judge whether their detection setup is well-tuned. It flags misconfigurations such as missing notification channels or an unsuitable threshold multiplier, and recommends specific tuning changes, helping teams get well-tuned alerting faster.

Run this after your first week of alerts to get an evidence-based starting point for tuning, or whenever alert volume seems too high or too low. Navigate to the desired cost management group, open the Monitoring tab, and select the Anomaly detection sub-tab to get started.

1. On the Anomaly detection sub-tab, click the sparkle icon (✦) next to Manage.
2. The Anomaly Insights panel opens with a full audit of the group's anomaly detection setup and history.

Insight breakdown

1. Setup score: an overall score with a status label (for example, Attention needed) summarizing whether the current configuration suits the group's cost behavior, along with a one-line explanation of the main issue.
2. Configuration: a summary of the group's current settings: whether automatic anomaly detection is enabled, the threshold multiplier, the minimum cost change floor, whether alerts are restricted to AI-verified anomalies, the detection interval, and the notification channels configured, with a plain-language summary sentence beneath.
3. Cost consistency: a 30-day daily cost chart with anomaly alert days marked, alongside the average daily spend, the group's typical day-to-day cost movement, and the number of anomalies received in the period. Includes a volatility callout explaining whether the group's cost movement makes some anomalies expected even when nothing is broken.
4. Common anomaly candidates: resources that most often drive cost anomalies for the group, each with a brief explanation of why that resource tends to swing and its average cost swing.
5. Threshold multiplier: a recommendation on whether to raise or lower the multiplier, based on the group's anomaly count and cost volatility.
6. Minimum cost change floor: a recommendation on whether to set or adjust the floor, based on the group's typical daily cost movement.
7. AI verification: a Relevance ("would you care") score and a Confidence score summarizing how many of the recorded anomalies were AI-verified as true versus judged not-real, and whether enabling Alert only on AI-verified would have suppressed the not-real ones.
8. What happens when you get an alert: a step-by-step explanation of the detection-to-incident pipeline: the statistical trigger, AI classification, severity assignment, channel routing, and incident logging.
9. Alert routing map: flags gaps in notification setup, such as no notification channels configured, or a severity with no channel configured to receive it.
10. How anomaly detection works here: a plain-language recap of the group's specific detection baseline and sensitivity.
11. Recent anomaly history: a table of recent anomalies with date, cost change amount, the resource involved, assigned severity, and the AI verification result with a confidence percentage.
12. Severity distribution: a breakdown of how many recorded anomalies fall into each severity band (Info, Warning, Issue, Critical), with a one-line interpretation.
13. Recommendations to improve: a numbered list of concrete tuning actions, such as raising the threshold multiplier, setting a minimum cost change floor, adding notification channels, fixing routing gaps, or enabling AI-verified-only alerts.

Export

The full Anomaly Insights report can be saved using the Save as PDF button at the bottom of the panel.

Example scenario

A FinOps analyst wants to verify that the Kovai cost management group's anomaly detection is properly tuned. They open Anomaly Insights from the Anomaly detection sub-tab. The panel shows a setup score of 77 (Well configured): the most sensitive multiplier (0.1x) is paired with a consistent cost pattern, and no minimum cost change floor is set. The group's average daily spend is $441, with a typical day-to-day movement of $40, and 15 anomalies were received in the last 30 days. Alerts route to ServiceNow; the Alert only on AI-verified toggle is off. The AI verification section shows Relevance: 88% and Confidence: 92%. Of 7 recent AI-classified anomalies, 5 were verified true and 2 were judged not-real. Turning on Alert only on AI-verified would have suppressed those 2 not-real anomalies. The severity distribution skews toward Issue and Critical (43%), confirming these are real problems rather than noise. Anomaly Insights recommends:

1. Raise the threshold multiplier to around 1.0x to reduce false-positive noise for this consistent group.
2. Set a minimum cost change floor near $20 to suppress trivial day-to-day changes on a group that typically moves about $40 a day.
3. Enable Alert only on AI-verified once tuned; it would have suppressed the 2 anomalies the AI judged not-real.

Steps

Use the following steps to configure anomaly detection for a cost management group. Navigate to the desired cost management group, open the Monitoring tab, and select the Anomaly detection sub-tab to get started.

1. On the Anomaly detection sub-tab, click Manage and enable the Anomaly detection toggle.
2. Optionally, select Send alerts only for anomalies classified as true by AI to record and send alerts only for anomalies the AI verifies as genuine. Leave this cleared to record and send both AI-verified and AI-classified false anomalies to your configured channels.
3. Set a Threshold multiplier to define detection sensitivity.
4. Optionally, set a Minimum cost change to alert on to suppress alerts for cost changes at or below this amount, regardless of the threshold multiplier. Leave this blank for no floor.
5. Under Notification settings, select the checkbox next to each channel you want to receive alerts on. For a selected channel, you can override Alert for severities and Anomaly type: a channel receives an alert only when the anomaly's severity is included in that channel's Alert for severities.
6. Set the Anomaly type for each selected channel (All, Verified by AI, or Not verified by AI) to control which anomalies that channel receives based on AI classification.
7. Click Save.

Cost anomaly report

When an anomaly is detected, Turbo360 sends a Cost anomaly alert email to your configured recipients. The email identifies the affected account and cost management group, shows the cost on the previous day and the current day side by side, and states the absolute and percentage increase prominently. A Potential root cause table lists the subscription and resource most likely responsible for the spike, each with its individual cost contribution.

The email also includes an AI review block showing the assigned severity (for example, Issue or Critical), whether the anomaly is tagged Likely a real anomaly or False anomaly, a Likely to matter to you percentage, a Confidence it's real percentage, and a short AI-generated explanation of why the anomaly was flagged. An Explore detailed insights button opens the cost analysis section of the corresponding cost management group directly in Turbo360.

Alert incidents

Anomalies detected within the configured interval are logged as incidents. On the Anomaly detection sub-tab, click View incidents to review them. Each incident lists the cost for the previous and current day, the amount and percentage of the cost increase, and the Potential root cause: the subscription and resource most likely responsible for the spike. An AI Review section shows the assigned Severity (Critical, Issue, Warning, or Info), whether the anomaly is tagged Likely a real anomaly or False anomaly, a Likely to matter to you percentage, a Confidence it's real percentage, and a short AI-generated explanation of why the anomaly was flagged.

All anomaly incidents are also visible in the Incidents sub-tab of the Monitoring tab, where they can be managed alongside Group budget and Custom monitor incidents. See Managing monitoring incidents for details.

Troubleshooting

1. No anomaly alerts are being received despite clear cost spikes
   Cause: The anomaly detection toggle may be disabled for the group, no notification channels are configured, or the threshold multiplier is set too high relative to the group's normal cost volatility.
   Fix: Open the Anomaly detection sub-tab and confirm the toggle is enabled. Check that at least one notification channel is configured under Notification settings. If alerts are configured but not firing, lower the threshold multiplier to increase sensitivity, or use Explain with AI to get a tuning recommendation based on the group's actual cost history.

2. Too many anomaly alerts are being generated — alert fatigue
   Cause: The threshold multiplier is set too low relative to the group's natural cost variability, causing normal day-to-day fluctuations to trigger alerts.
   Fix: Raise the threshold multiplier to reduce sensitivity. Set a Minimum cost change to alert on to suppress alerts for small absolute cost changes. Enable Send alerts only for anomalies classified as true by AI to filter out AI-identified false positives. Use Explain with AI for a data-driven recommendation on the right multiplier for this group.

3. Explain with AI icon is not visible on the Anomaly detection sub-tab
   Cause: The AI Agents feature permission is not enabled on the signed-in user's role, or the Monitoring permission is not set to at least Read.
   Fix: Ask an Account owner to enable the AI Agents permission under Specify feature permissions, and confirm Monitoring is toggled on with at least Read access. Both conditions must be met for the icon to appear.

4. Anomaly detection is enabled but no incidents appear in View incidents
   Cause: No cost changes have exceeded the anomaly threshold since detection was enabled. If the group is new, there may also be insufficient historical data — detection requires 30 days of daily cost data to calculate a meaningful baseline.
   Fix: Wait for the group to accumulate at least 30 days of cost data. If the group is established, lower the threshold multiplier temporarily to confirm detection is working, then tune upward from there.

5. Cost anomaly report email arrived but the navigation link does not open the correct group
   Cause: The cost management group may have been renamed, moved, or deleted since the alert was generated, causing the link to resolve incorrectly.
   Fix: Navigate to the cost management group manually via Cost Analyzer and open the Monitoring tab > Anomaly detection sub-tab to review the anomaly using View incidents.

FAQs

1. What is the difference between anomaly detection and group budget monitoring?
   Group budget monitoring alerts when total spend crosses a fixed threshold you define. Anomaly detection uses statistical analysis against your historical spend pattern — no fixed value is required. It flags cost changes that are unusual relative to your group's own history, making it better suited for catching unexpected spikes in groups where spend varies naturally, rather than enforcing a hard budget ceiling.

2. How long does it take for anomaly detection to start working after a group is created?
   Anomaly detection requires 30 days of daily cost data to calculate a meaningful standard deviation baseline. For groups with less than 30 days of history, the baseline uses whatever data is available, which may result in less accurate detection until the full window is established.

3. Will anomaly detection flag cost decreases as well as cost increases?
   Yes. The detection algorithm uses the absolute value of today's cost change — abs(TodayChange) — so both significant increases and significant decreases relative to the baseline are flagged. A large cost drop (for example, from a resource being deleted or a reservation being applied) can trigger an alert in the same way a spike does.

Related articles

• Group budget monitoring
• Managing monitoring incidents
• AI Agents in Cost Analyzer
• OpenAI setup in Turbo360