Reading your Azure spend: subscription, resource group, resource
28 Jul 2026
Reading your Azure spend: subscription, resource group, resource
An Azure invoice is a single number with a lot of pages behind it. It tells you what left the bank account and nothing about what caused it. "€8,400 this month, €7,100 last month" is not information you can act on — it's a prompt to start looking. The looking is the work, and it has a shape: four levels, each one answering a different question, each one narrowing the search until you're holding a resource and a decision instead of a total and a bad feeling.
The four levels, and what each one answers
Every level of the hierarchy is a different question. Skipping one is how people end up staring at a resource-level chart with no idea whether the number is normal.
| Level | The question it answers | What a bad answer looks like |
|---|---|---|
| Subscription | Which budget owner does this belong to? | One subscription holding prod, dev and a client's workload together. |
| Resource group | Which workload or environment is spending? | An rg-default or NetworkWatcherRG in your top 5. |
| Resource | Which specific thing is the line item? | A resource nobody recognises and no tag explains. |
| Meter | Which behaviour of that thing costs money? | Storage where you expected compute — egress, transactions, ingestion. |
The drill-down, in four passes
One month over another mixes a real change with calendar noise — February is 10% cheaper than January on compute alone. Put six months of daily spend on one line and the question changes from "is this higher?" to "when did it change?". A step means a deployment; a ramp means growth; a spike that returns means a job someone ran.
Your biggest resource group is your production workload and it is supposed to be big. Sort by change over the window instead, and the list reorders around what actually happened. The RG that went from €40 to €600 matters more than the one that stayed at €3,000.
This is where you separate "expensive because it's working" from "expensive because it was forgotten". Unattached disks, idle public IPs and old snapshots show up as full-price line items with no workload behind them — the subject of orphaned Azure resources.
Compute hours say "resize or schedule it". Disk says "wrong tier". Egress says "wrong architecture". Log ingestion says "someone enabled all diagnostic categories". Same resource, four different conversations — and only the meter tells you which one to have.
What makes the drill-down fail
- Monthly granularity. A monthly total hides the day the change happened, and the day is the fastest route to the cause: match it against your change log and the investigation is usually over.
- Untagged resources. Without an owner or environment tag, the "unallocated" bucket becomes your largest cost centre and you can't push any of it back to the team that created it.
- Amortisation confusion. Reservations and savings plans land as a lump in actual cost and spread evenly in amortised cost. Pick one view and stay in it — comparing an actual month to an amortised month invents changes that never happened.
- Reading the invoice instead of the data. The invoice arrives after the month it describes. By the time it lands, whatever caused the increase has been running for up to 30 days more.
Access is the prerequisite
None of this works without the right billing scope — the reason a lot of teams never get past the invoice total. Cost Management data lives at the billing-account scope, which is separate from your Azure RBAC on the subscriptions; a service principal with Reader on every subscription can still get a 404 from the billing API. That plumbing, and the exact role to grant, is covered in how to give a tool read-only access to your Azure costs.
Make it a standing view
Done by hand in the portal, this is 20 minutes per subscription and it never survives a busy month — which is why most teams do it once, after a bad invoice, and not again. The durable version is a standing view: daily spend per subscription, ranked resource groups, resources inside them, meters inside those, always one click apart. GraphPaaS keeps that drill-down per tenant and refreshes it on every sync, so a cost question takes a minute instead of an afternoon — and for an MSP, the same structure repeats across every tenant you manage, without a portal tab per client.
Go from the Azure total to the resource that moved it — subscription, resource group, resource and meter, in one view per tenant.
Drill into your Azure spend →