← All notes

Azure11 Nov 20263 min readBy the X-Axis consulting team

Where an Azure bill drifts, and a one hour review that finds it

Cloud bills do not jump. They creep, a few dollars at a time, in places nobody owns. Here is where we look first.

30 second answer

Look for disks and addresses attached to nothing, machines sized for a peak that never came, test environments running overnight, and anything without an owner tag. Then set a budget alert, so the next drift sends an email.

Nobody gets a shock from an Azure invoice in the first year. The shock comes in the third, when someone compares it with the first and cannot say what all the extra is for. Nothing dramatic happened in between. A test environment was built for a project and never removed. A machine was made larger during a busy week and never made smaller. Ten dollars here, forty there.

A first review of a bill nearly always goes the same way.

The one hour review, in order
  1. OrphansDisks, snapshots and addresses attached to nothing
  2. SizeMachines far larger than their real load
  3. HoursTest and development running nights and weekends
  4. OwnersResources with no tag saying who needs them
  5. AlertsA budget that emails someone before month end

Things attached to nothing

When you delete a virtual machine, its disks do not always go with it. Neither do its snapshots or its public address. They sit there, billed monthly, doing nothing. This is the easiest money to recover, because nobody argues for keeping a disk that belongs to a server that no longer exists. If you are nervous, take a final snapshot, wait a month, then remove that too.

Machines bigger than their work

Sizing is usually a guess made on the day something was built, and the guess is generous because nobody wants a slow system at launch. Look at what the machine has actually used over the past month. If the processor has not passed a fifth of its capacity, it can almost certainly drop a size, and each step down often costs close to half as much.

Environments that never sleep

A development environment used from nine to six on weekdays is idle for about three quarters of the week. Shutting it down on a schedule is one of the few savings that costs nothing and annoys nobody, provided you tell the developers first.

Resources nobody owns

This is the root of the other three. If a resource has no tag saying who asked for it and why, nobody will ever feel safe deleting it, so it stays for good. We ask for two tags on everything, an owner and a purpose, and we treat anything without them as a question to be answered this month.

No alarm

Finally, set a budget in cost management with an alert that emails a named person at 80 percent of last month's spend. It takes five minutes. Without it, the next drift will be found the same way this one was, by someone squinting at an invoice.

What comes after the first hour

The quick pass finds waste. The larger savings come from commitment. If a workload will run all year, paying for it at pay as you go rates is the expensive way to buy it, and a one year or three year commitment on steady usage is usually worth pricing. That is a longer conversation, because it needs a view of what the next year looks like, and it should come after the cleanup. Committing to a bill that is a third waste just locks in the waste.

Where X-Axis fits

Cost reviews are part of our Azure consulting for clients in the United States and Canada. Ask us for one.

Do this month

Tick them off as you go. Nothing is saved or sent.

Want a second pair of eyes on this?

Ask for a cost review

Keep reading

Azure4 min read
99.2%of account compromise attacks blocked by MFA, per Microsoft

Azure now asks your scripts for a second factor

Mandatory multifactor sign in reached the command line and deployment tools. If a nightly job runs under a person's account, it is living on borrowed time.

30 second answerAzure requires multifactor authentication for user accounts that manage resources through the CLI, PowerShell, SDKs and deployment tools. Service principals and managed identities are not affected. Move any automation that signs in as a person.
Azure3 min read
31 Mar 2026new virtual networks default to private

New Azure networks no longer reach the internet on their own

Since 31 March 2026 a new virtual network starts private. A fresh server that cannot download updates is the usual first symptom.

30 second answerVirtual networks created after 31 March 2026 default to private subnets. Machines in them need an explicit outbound route, such as a NAT gateway, before they can reach the internet. Existing networks keep working as before.
Microsoft 3654 min read
$1.50more per user, per month, on Business Standard

Your next Microsoft 365 renewal costs more. Here is the arithmetic.

List prices went up on 1 July 2026. Most firms will only notice when the renewal quote lands, so do the sum now.

30 second answerBusiness Basic went from $6 to $7 and Business Standard from $12.50 to $14 per user per month. Business Premium stayed at $22. You pay the new rate from your first renewal after 1 July 2026.