Per-team Azure cost anomaly alerts, one baseline per resource group or tag
Native anomaly detection is subscription-wide and capped at five rules. This gives every resource group or tag value its own baseline and its own alert.
Deploys as a managed application in your own subscription. No vendor backend, no data egress.
Flat monthly fee, billed by Microsoft.
The gap
A four-times jump in one team's resource group is invisible in a large, steady subscription total, and you cannot stand up an anomaly rule per team because Azure caps you at five. The people who could fix a spike are the last to hear about it.
What it does
Daily per-slice cost from Cost Management, sliced by resource group or by a tag such as Team, CostCenter, or Environment.
Trailing baseline per slice (mean and standard deviation) with a z-score test and a minimum dollar delta to suppress noise on tiny slices.
Handles Cost Management latency explicitly: the newest days are restated by Azure, so the judged day is offset and the baseline excludes it.
Short-history slices fall back to a percent-jump rule; brand-new slices are never alerted.
Anomalies ranked by dollar delta and posted once per slice per day.
The daily card: each spiking slice with latest cost, baseline, delta, and z-score.Slicing by tag value gives each team its own detector.Latency handling: the judged day and the baseline window.
Honest about its limits
Alert only. It never stops, caps, deallocates, deletes, or modifies anything; it has no write permission at all. Cost Breaker is the sibling that enforces.
Amounts are in your billing currency as Cost Management reports them, which lag real usage by a day or more.
Read-only. This app reports and alerts; it changes nothing in your subscription.
How it runs, and what it needs
A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription
by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so
nothing runs until you say so. Every role it asks for, and why:
Cost Management Reader
read daily cost per slice
Reader
resolve resource groups and tags
Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.
FAQ
Does any data leave my subscription?
No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.
How is it billed?
A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.
How do I remove it?
Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.
Native anomaly detection is subscription-wide and capped at five rules. This gives every resource group or tag value its own baseline and its own alert.
