How to investigate an Azure cost spike

Start with a like-for-like comparison

Before investigating resources, confirm the tenant, subscription selection, currency and cost basis. Compare complete months or the same number of elapsed days. A partial current month compared with a complete previous month can hide growth. Azure usage and billing records can arrive late, so note the last refresh time and any missing subscriptions.

1. Open Azure Cost Management → Cost analysis at the relevant subscription or billing scope.
2. Choose the reporting dates and record whether the view uses Actual cost or Amortized cost.
3. Check filters, credits and the reporting currency before comparing totals.

Find the services contributing to the increase

Group costs by service and calculate current-period cost minus previous-period cost. Sort by the monetary increase first: a small service can grow by 500% and still contribute less than a modest change in a large service. Treat services with no previous spend as new rather than dividing by zero.

1. Compare the same service list across both periods, including services that disappeared.
2. Check whether increases are offset by decreases elsewhere.
3. Record the top contributors and their first day of increased spend.

Drill into the resource and meter

For each large contributor, group by resource group, resource and meter. Look for new resources, larger VM sizes, additional disk capacity, backup retention, data transfer or more hours of operation. A higher bill can reflect a quantity change, a price change or both. Check quantity units before comparing unit rates; per-hour and per-GB meters are not interchangeable.

Separate billing events from consumption

An upfront reservation purchase can create a large Actual cost spike even when the workload did not grow. Inspect PricingModel and ChargeType, and look for purchase or refund records. Use Amortized cost to examine how reservation costs are allocated over time. Do not assume every reservation-priced row means a new purchase.

Correlate the change with activity

Compare the first expensive day with Azure Activity Log events such as VM resizing or resource creation. Timing is a clue, not proof: a deployment event does not establish how much cost it caused. Confirm the affected resource IDs and meters in the billing data before assigning a cause.

Worked example and follow-up

Illustrative example: Compute rises from ₹80,000 to ₹100,000 while Storage rises from ₹10,000 to ₹15,000. Storage has the larger percentage increase, but Compute contributes ₹20,000 of the ₹25,000 total change. Investigate Compute first. Document the billing evidence, agree an action with the workload owner and verify the next complete billing period. Cloudledger’s Cost Explorer brings month comparison and daily resource drilldowns into the same workflow.