Custom monitoring

Overview

Custom monitors let you track Azure spend against narrow, rule-based criteria, going beyond the broader Group budget and Anomaly detection options. Scope a monitor to a single resource type (such as virtual machine costs) or a specific tag, so targeted overruns don't get lost inside an aggregate budget.

Business value

Custom monitors catch cost deviations within narrow segments that broader budgets can miss, giving teams earlier, targeted alerts instead of waiting for an aggregate threshold breach.

Prerequisites

A Cost management group must exist before you can configure a custom monitor. You can create a monitor from an existing Cost management group, or create a new one first and then configure the monitor for it.

Required permissions

Custom monitors use the Monitoring feature permission, available under Specify feature permissions during role creation.

• Read: allows users to view all monitors.
• Manage: allows users to perform operations such as editing and enabling monitors.

Dependencies

Custom monitors depend on a Cost management group.

How it works

• Each monitor runs on a defined interval: Daily, Monthly, or Last 7 days.
• A monitor applies one or more rules, each scoped to selected subscriptions and a cost metric: Actual cost or Amortized cost.

• Filters narrow each rule to specific cost data. See Cost filtering for details.
• Each rule defines a budget as Static (a fixed value) or Dynamic (a defined cost difference that triggers a violation).

For Static budgets, you can also configure alert conditions: percentage thresholds that trigger alerts as spend approaches the limit, before a full breach occurs.

• Alerts route through a selected escalation policy and notification channel.
• On every monitoring cycle, the latest values are compared against the budget, and percentage thresholds for Static budgets, and alerts trigger on breach.
• Triggered alerts become Incidents, which can be tracked, resolved, and reopened at any time from the Incidents sub-tab of the Monitoring tab.

Steps

Use the following steps to create, update, remove, enable or disable custom monitors, and manage alert incidents. Navigate to the desired cost management group, open the Monitoring tab, and select the Custom monitors sub-tab to get started.

Create a custom monitor

Creating a custom monitor defines the rules, budget type, and alert configuration that Cost Analyzer evaluates on every monitoring cycle.

1. On the Custom monitors sub-tab, click + Add monitor.

2. Enter a name for the monitor.

3. Choose Daily, Monthly, or Last 7 days as the run interval. Click Next.

4. Click Add rule to define a monitoring rule.

5. Name the rule, select the subscriptions to monitor, and choose Actual cost or Amortized cost. Click Next.

6. Add filters to scope the cost data, then click Next.

7. Choose Static or Dynamic to define the budget limit.

   For Static budgets, click Alert conditions, set the desired percentage limits, and click Apply.

8. Click Add to save the rule, then Next to configure alerts.

9. Select an escalation policy with the preferred notification channel, then click Add to finish.

Update a custom monitor

Updating a monitor lets you change its name, run interval, rules, budget settings, or alert configuration without removing and recreating it.

1. On the Custom monitors sub-tab, click the ⋯ Actions menu next to the monitor and select Manage.
2. Make the necessary changes and select Update.

Remove a custom monitor

Removing a monitor permanently deletes it and stops all future evaluations and alerts for that monitor.

1. On the Custom monitors sub-tab, click the ⋯ Actions menu next to the monitor and select Delete.
2. Confirm with Delete.

Enable or disable a custom monitor

Enabling or disabling a monitor lets you pause evaluations temporarily without removing the monitor's configuration.

1. On the Custom monitors sub-tab, use the toggle in the Status column next to the monitor to enable or disable it.

Manage alert incidents

Managing incidents lets you track, acknowledge, close, and reopen triggered alerts so your team can maintain a clear record of cost violations and their resolution.

All incidents from custom monitors appear in the Incidents sub-tab of the Monitoring tab. Filter by the Custom monitors category tab to view only custom monitor incidents. Each incident can move between:

• Open: violations exist on the incident.
• Acknowledge: the violation is under investigation.
• Close: the violation is resolved and the incident is no longer relevant.
• Reopen: the incident is still problematic.

Change the state individually from the Context menu ( ⋮ ), or in bulk by selecting multiple incidents and choosing the option from the Actions dropdown.

Track user actions: Select view user actions from the Context menu ( ⋮ ) of an incident to see every action taken, who took it, when, and the resulting state change.

View notification history: Select view notification details from the Context menu ( ⋮ ) of an incident to see channel-level delivery details, including the reason for any failed transmission.

Filter incidents by Incident status or Date. See Managing monitoring incidents for full incident management details.

Status calendar

The Monitoring tab Overview sub-tab includes a status calendar showing the historical summary of Cost Analyzer's cost alert status. The last 30 days of data is always available for reference.

Configuration

Troubleshooting

1. A monitor is not generating any incidents despite spend being above the budget
   Cause: The monitor may be disabled, or the cost data for the selected subscriptions has not yet been refreshed for the current evaluation cycle.
   Fix: Confirm the monitor is enabled using the toggle on the Custom monitors sub-tab. Check that the subscriptions in the rule have current cost data visible in the Analysis view. If data appears delayed, reset the cached data from the Essentials section and wait for the next monitoring cycle.

2. Alerts are triggering but no notifications are being received
   Cause: The escalation policy may be misconfigured, or the notification channel may have a delivery failure — for example, an invalid webhook URL, expired credentials, or a misconfigured email recipient.
   Fix: Open the incident's Context menu ( ⋮ ) and select view notification details to see the channel-level delivery result and the reason for any failed transmission. Correct the channel configuration in Managing notification channels and trigger a test if available.

3. The Add monitor option is not visible
   Cause: The signed-in user does not have the Monitoring: Manage feature permission on their role.
   Fix: Ask an Account owner or Owner to grant the Manage permission under the Monitoring feature in the user's role configuration.

4. Alert conditions are not available when setting up a rule
   Cause: Alert conditions are only available for Static budget types. They are not shown when Dynamic is selected.
   Fix: Switch the budget type to Static to access the Alert conditions option and configure percentage thresholds.

5. Incidents are not appearing after a monitoring cycle completes
   Cause: The monitor's rules may not be matching any cost data — for example, the filter scope is too narrow, or the subscriptions selected in the rule have no cost activity for the chosen interval.
   Fix: Review the rule's filter configuration and verify that the selected subscriptions have cost data visible in the Analysis view for the chosen run interval. Adjust the filters or interval as needed and allow the next cycle to evaluate.

FAQs

1. What's the difference between Actual cost and Amortized cost?
   Actual cost shows raw usage and purchase charges as they appear on the invoice. Amortized cost spreads reservation purchase charges evenly across the term and links them to the resources that used them.

2. When should I use a Static budget instead of a Dynamic budget?
   Use a Static budget when you want to monitor against a fixed value and trigger alerts at defined percentage thresholds. Use a Dynamic budget when you want to detect violations based on a defined cost difference rather than a fixed limit.

3. Who can access custom monitors?
   Users with the Monitoring feature permission enabled on their role. Read access allows viewing monitors; Manage access allows editing and enabling them.

Related articles

• Group budget monitoring
• Automatic anomaly detection
• Managing monitoring incidents
• Managing escalation policies
• Managing notification channels
• Cost filtering