What it is
A durable, sustained increase in a resource's spend, a step-change to a new higher steady-state rather than a transient burst. A tier was bumped, replication was turned on, retention was extended, an autoscale floor was raised, and the resource simply costs more from that day forward. Because the new level is stable, it looks like normal operation and rarely gets questioned.
Why it happens
A spike is loud because it goes back down; a pattern shift is quiet because it doesn't. The cost moves to a new plateau and stays there, so after a week or two the higher number looks like the baseline. Anyone glancing at a cost chart sees a flat line at the new level and moves on.
Static budget alerts make this worse. A step-up nudges the monthly total up once; if that crosses the cap you raise the cap, and now the elevated spend is baked into the budget forever with no further alerts. Threshold tooling has no concept of "this resource used to cost X and now costs Y with no return," which is exactly the pattern that a permanent step-up creates. Detecting it means recognizing a sustained change in a resource's own level, not a momentary excursion and not a subscription total drifting up.
What it costs / blast radius
Because the shift is permanent, the cost is the daily step-up paid every single day from the change onward, so a modest-looking increase compounds into a large annual figure the longer it goes unnoticed. A spike costs you the days until it's caught; a pattern shift costs you until someone actively decides to roll it back. (Authored assessment of Azure alerting behavior, not a measured figure; the dollars depend on the resource and how long the new level persists.)
See it
resource budget 'Microsoft.Consumption/budgets@2023-05-01' = {
name: 'monthly-cap'
properties: {
category: 'Cost'
timeGrain: 'Monthly'
amount: 50000 // bumped last quarter after spend stepped up
notifications: {
over90: {
enabled: true
operator: 'GreaterThan'
threshold: 90
contactEmails: [ 'finops@example.com' ]
}
}
// A permanent step-up trips this once. You raise the cap, and the
// higher spend is now the accepted normal, forever, no more alerts.
}
}// A forecast alert reacts within days of a step-up: the new run rate moves
// the month's projection over the cap while the actual total is still fine.
// Scoping the budget to one workload keeps the number meaningful.
targetScope = 'subscription'
resource budget 'Microsoft.Consumption/budgets@2023-05-01' = {
name: 'rg-data-platform-monthly'
properties: {
category: 'Cost'
timeGrain: 'Monthly'
amount: 8000 // sized to THIS workload, not the whole sub
timePeriod: {
startDate: '2026-08-01T00:00:00Z'
}
filter: {
dimensions: {
name: 'ResourceGroupName'
operator: 'In'
values: [ 'rg-data-platform' ]
}
}
notifications: {
forecastOver100: {
enabled: true
operator: 'GreaterThan'
threshold: 100
thresholdType: 'Forecasted' // fires on the projected month, not the spent total
contactEmails: [ 'finops@example.com' ]
}
}
}
}
// The remaining gap: after the alert, a human re-decides the number. Raise
// the cap and the new level is accepted; the budget can't tell you a
// resource used to cost less. That comparison needs a per-resource history.How StratoLens helps
StratoLens tracks each resource's spend over time and distinguishes a permanent step-up from a passing spike, flagging resources that have moved to a durably higher level, per resource, across every subscription, so a quiet plateau doesn't get absorbed into "the new normal." The analysis runs continuously in your own tenant, so a step-up gets a second look instead of a raised budget cap.