How to triage a cost anomaly

Triage is the loop that keeps the Anomaly Inbox useful. An inbox nobody works through stops being an inbox and becomes a list.

The same actions work identically on Savings & Waste and WAF Recommendations, so learning it once covers all three.

Cost group members only

You need to be an Owner or a Member of the cost group the item belongs to. Anyone can open the affected resource in the Azure portal, whatever their role.

Step 1: Understand it before you act

Open the Anomaly Inbox and read the row: its cost group, root-cause explanation, any person it has been assigned to, and the impact. Impact is the spend above normal, not the resource’s total cost.

Then use Next step. It opens The Ledger on Billed cost, filtered to the affected subscription, resource group or resource and with Period set to the day of the spike. That is the slice you would otherwise assemble by hand.

Step 2: Choose what to do

Each row has a split action. On the Open tab, Assign is on the button and its caret opens the other actions. On the Snoozed or Dismissed tabs, Reopen is on the button instead.

Assign or comment

Assign lets you choose a member of that item’s cost group and add an optional comment. The assignment is saved and appears in that person’s Assigned to me list under the alert bell.

If the cost group has nobody available to choose, or the only member is already assigned, the same dialog offers Add comment instead.

Snooze

Snooze for a period. Moves to the Snoozed tab. Choose 1 day, 3 days, 1 week, 2 weeks, 1 month or 3 months.

Use it for “this is real, I’ll deal with it after the release”. It comes back rather than being forgotten, which is the whole point.

Dismiss

Dismiss with a reason. Moves to the Dismissed tab. The reason is required: at least five characters and no more than a thousand.

Use it when the spend is explained and expected: a planned migration, a deliberate scale-up, a one-off load test.

Write the reason for the next person

“Expected” is useless in three months. “Load testing for the November launch, approved by Priya” stops the same anomaly being re-investigated by someone else. The reason is stored on the item and visible in the cost group’s audit trail.

Reopen

Move back to the Open tab. Available on anything snoozed or dismissed. Use it when a dismissal turns out to have been wrong.

What you can’t do

There is no “mark as complete”. The Completed tab exists and nothing you do puts anything in it.

An anomaly completes when the spike actually clears in Azure and CloudMonitor notices on its next run. If spend has genuinely returned to normal, leave it. It will close itself. If the spend is expected to continue, record that decision with Dismiss rather than waiting.

An Aged out tab can also appear. CloudMonitor puts an untriaged item there after its spike day leaves the detailed-cost window and can no longer be investigated. Aged out does not mean fixed.

A workable routine

1. Filter the inbox to your cost groups using the top-bar filter.
2. Sort by severity and work the top.
3. Don’t stop at the high ones. Severity is led by how much cost moved against the detection threshold, with percentage change as a secondary signal. New spend has no prior-day percentage baseline, but its cost change still affects priority.
4. For each: read the root cause, click Next step, decide.
5. Anything you can’t decide in two minutes: Snooze it rather than leaving it open. An open item should mean “needs a decision”, not “nobody has looked”.

Where alerts arrive

Anomalies also surface in Alerts and in the bell in the top bar, alongside budget threshold alerts, so you don’t have to keep the Anomaly Inbox open all day. Select Open anomaly in Alerts, or View in the bell, to open that exact anomaly.