Azure Anomaly Detector is retiring. How to keep per-team cost-spike alerts.

If you built anything on Azure AI Anomaly Detector (or Metrics Advisor), the clock is running. Microsoft's own Anomaly Detector lifecycle page sets the date: new resource creation was disabled back in September 2023, and the service is fully retired on October 1, 2026. After that, the API endpoints, models, and configurations are gone.

Microsoft points general time-series workloads toward Microsoft Fabric, Azure Data Explorer, and Stream Analytics. Fair enough for telemetry. But a lot of teams used Anomaly Detector for something narrower and more boring: watching Azure spend and catching a cost spike before it became a month-end surprise. For that, standing up Fabric or a KQL pipeline is a lot of machinery for one question: did any team's daily cost just jump?

This is about that specific case: keeping per-team, per-resource-group cost-spike alerts once Anomaly Detector is gone.

The hole: native cost anomaly detection is subscription-scope only

Azure Cost Management does ship built-in anomaly detection, but read Microsoft's own documentation carefully. The page Identify anomalies and unexpected changes in cost states plainly that "anomaly detection is only available for subscriptions." That single line is the gap:

• Subscription scope only. A spike inside one team's resource group gets averaged into the subscription total. A team that quietly doubles its spend can be invisible in the subscription number.
• The rules are capped. Native anomaly alert rules are limited per subscription, so you cannot give every team, environment, or cost center its own detector and its own recipient.
• The signal routes to the wrong person. Whoever can fix a runaway deployment is the team that owns the resource group, not whoever reads the subscription-level alert.

The do-it-yourself method

You can build this against the Cost Management query API. The building blocks:

• Pull daily actual cost per slice. Query Microsoft.CostManagement/query with granularity: Daily and a grouping on resource group or a tag key such as Team, CostCenter, or Environment. Follow nextLink paging or you will silently truncate large tenants.
• Handle cost-data latency, or drown in false positives. Cost Management actuals for the most recent one to three days are incomplete and get restated as usage is ingested. If you judge yesterday against a full baseline, the newest day reads artificially low and then spikes every morning as it settles. Drop the most recent two days from both the judged day and the baseline, and judge the day at (today minus 2).
• Compute a trailing baseline per slice. Take the mean and standard deviation over the last N days, then the judged day's z-score. Flag an anomaly when the z-score crosses a threshold (3 is a sane default) and the absolute dollar increase is large enough to matter (a floor around ten dollars kills noise on tiny slices).
• Handle short history. New slices lack enough trailing days for a trustworthy z-score. Fall back to a percent-jump rule (latest at least fifty percent over baseline), and do not alert brand-new slices with under three days of data.
• Rank and route. Sort anomalies by dollar delta and post to the owning team's Teams channel with slice name, latest cost, baseline, delta, and z-score.

That works. It is also a real project: pagination, the latency trap, per-slice statistics, a scheduler, and a Teams webhook, plus the ongoing job of keeping it running.

A ready-made option: Cost Spike Sentinel

If you would rather not build and maintain the detector above, Cost Spike Sentinel is that pattern packaged. Every day it queries Cost Management for daily cost per resource group or per tag (Team, CostCenter, Environment), computes a trailing z-score baseline per slice, handles the latency trim, falls back to a percent-jump rule for short history, and alerts the owning team in Teams the moment a slice spikes. Two honest caveats: it is alert-only (no write permission at all, it never caps, stops, or deletes anything), and it replaces the cost use case, not all of Anomaly Detector (for general time-series, look at Fabric or Data Explorer).

Key facts

• Anomaly Detector retirement: October 1, 2026. New resources already disabled.
• Native cost anomaly detection: stays, but subscription-scope, rule-capped, and routes to the subscription owner, not the team.
• The gap: per-slice, day-granularity cost-spike alerts to the team that owns the slice.
• Options: the DIY detector above, or a packaged alert-only one.

Related reading: how to put a hard spending cap on Azure.

Written by the team at Katabarwa Labs. We build small, single-purpose Azure tools that run entirely inside your own tenant. Questions: abaho@llmgraph.ai.