Cost Anomaly Detection setup through powershell script

Question

Cost Anomaly Detection setup through powershell script

Guha, Satyaki 20

Hi I am trying to setup cost anomaly alerts for all subscriptions under my management group through a powershell script. When I tested for one subscription, I got a status 200 code as the response, but when I checked from the console the cost alert rule was still not created.

Can anyone please help me whats going on since there are a lot of subscriptions, I want to automate this through a script. I can provide the script if needed.

Vinod Pittala 6,310 Reputation points Microsoft External Staff Moderator

2025-08-14T15:41:28.6333333+00:00
Hello Guha, Satyaki,

Firstly, verify that you have the Owner, Contributor, or Cost Management Contributor role on the subscription.

Anomaly alerts are currently available only in the Azure public cloud. If you are using a government cloud or any of the sovereign clouds, this service is not yet available.

Anomaly Detection in Azure Cost Management is available via the Azure Portal under Cost Analysis. However since you choose to automate the process using Powershell script, you can automate the creation of anomaly alert rules using the Scheduled Action API, specifying the scheduled action kind as InsightAlert.

To do this, can use Invoke-AzRestMethod in PowerShell to deploy this JSON payload across all subscriptions under a management group.

Refer: https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/analyze-unexpected-charges#why-am-i-not-able-to-create-an-anomaly-alert-rule

If the comment helpful, please click Upvote it.

Thanks
Guha, Satyaki 20 Reputation points

2025-08-14T16:09:20.0266667+00:00

Yes I do have the permissions, and I am following exactly the automation process you mentioned and I am even getting a status code of 200 after I apply the json payload for this example subscription. Still from portal not able to see it being created at that subscription level Also I am able to create the alert from the portal as well just to double-check whether I have the permissions or not
Vinod Pittala 6,310 Reputation points Microsoft External Staff Moderator

2025-08-14T16:45:19.5733333+00:00

Hello Guha, Satyaki,

I have reached out you via private message, please respond there.

Thanks
Rahul Jorrigala 4,320 Reputation points Microsoft External Staff Moderator

2025-08-15T23:55:17.9+00:00

Hello Guha, Satyaki,

Just want to check if the above Comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T01:18:03.1233333+00:00

Hello Guha, Satyaki,

Just want to check if the above Comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou
Guha, Satyaki 20 Reputation points

2025-08-18T06:21:14.49+00:00

Hello apologies for a late reply, I am using api version 2023-11-01 and URL is constrcuted correctly. Is the version a problem?
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T08:10:21+00:00

Hi Guha, Satyaki
Please try using the version (2025-03-01) suggested by Rahul Jorrigala. We will also test with version 2023-11-01 in our environment and share an update with you.
Guha, Satyaki 20 Reputation points

2025-08-18T08:15:16.0666667+00:00

Okay It will be helpful if you can share an example JSON payload that you are providing while testing the same

Naveena Patlolla 5,365 Microsoft External Staff Moderator

This has already been shared above. Please update us with the results after testing.

{
  "properties": {
    "displayName": "Weekly anomaly by resource group",  
    "scope": "subscriptions/XXXXXXXXX",  
    "status": "Enabled",  
    "viewId": "/subscriptions/XXXXXXX/providers/Microsoft.CostManagement/views/ms:DailyAnomalyByResourceGroup",  
    "schedule": {
      "frequency": "Weekly",  
      "hourOfDay": 12,                // Hour of day the alert should run
      "daysOfWeek": [1],              // Set to Monday (1) to run weekly on Monday
      "weeksOfMonth": null,           // No specific weeks of the month
      "dayOfMonth": 0,                // Day of month, not needed for weekly
      "startDate": "2025-08-14T17:25:41.276Z",  // Start date for the scheduled action
      "endDate": "2026-08-14T17:25:41.276Z"     // End date for the scheduled action
    },
    "notification": {
      "subject": "Cost anomaly detected in subscription",  // Notification subject
      "message": "",  // Message body, if needed
      "to": ["******@gmail.com"],  // Email recipient
      "language": "en",  // Language for the notification
      "regionalFormat": "en"  // Regional format for the notification
    },
    "notificationEmail": "******@gmail.com"  // Notification email
  }
}

Guha, Satyaki 20 Reputation points

2025-08-18T08:44:27.86+00:00

Its working, thanks everyone. To clarify I wasnt giving the correct viewId
Guha, Satyaki 20 Reputation points

2025-08-18T08:45:53.6566667+00:00

Its working thank you everyone
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T09:42:23.91+00:00

I have converted the comment into an answer. Can you please "Accept the Answer"

Accepted answer

0 additional answers

Your answer

Vinod Pittala 6,310 Reputation points Microsoft External Staff Moderator

2025-08-14T15:41:28.6333333+00:00

Hello Guha, Satyaki,

Firstly, verify that you have the Owner, Contributor, or Cost Management Contributor role on the subscription.

Anomaly alerts are currently available only in the Azure public cloud. If you are using a government cloud or any of the sovereign clouds, this service is not yet available.

Anomaly Detection in Azure Cost Management is available via the Azure Portal under Cost Analysis. However since you choose to automate the process using Powershell script, you can automate the creation of anomaly alert rules using the Scheduled Action API, specifying the scheduled action kind as InsightAlert.

To do this, can use Invoke-AzRestMethod in PowerShell to deploy this JSON payload across all subscriptions under a management group.

Refer: https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/analyze-unexpected-charges#why-am-i-not-able-to-create-an-anomaly-alert-rule

If the comment helpful, please click Upvote it.

Thanks
Guha, Satyaki 20 Reputation points

2025-08-14T16:09:20.0266667+00:00

Yes I do have the permissions, and I am following exactly the automation process you mentioned and I am even getting a status code of 200 after I apply the json payload for this example subscription. Still from portal not able to see it being created at that subscription level Also I am able to create the alert from the portal as well just to double-check whether I have the permissions or not
Vinod Pittala 6,310 Reputation points Microsoft External Staff Moderator

2025-08-14T16:45:19.5733333+00:00

Hello Guha, Satyaki,

I have reached out you via private message, please respond there.

Thanks
Rahul Jorrigala 4,320 Reputation points Microsoft External Staff Moderator

2025-08-15T23:55:17.9+00:00

Hello Guha, Satyaki,

Just want to check if the above Comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T01:18:03.1233333+00:00

Hello Guha, Satyaki,

Just want to check if the above Comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou
Guha, Satyaki 20 Reputation points

2025-08-18T06:21:14.49+00:00

Hello apologies for a late reply, I am using api version 2023-11-01 and URL is constrcuted correctly. Is the version a problem?
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T08:10:21+00:00

Hi Guha, Satyaki
Please try using the version (2025-03-01) suggested by Rahul Jorrigala. We will also test with version 2023-11-01 in our environment and share an update with you.
Guha, Satyaki 20 Reputation points

2025-08-18T08:15:16.0666667+00:00

Okay It will be helpful if you can share an example JSON payload that you are providing while testing the same
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T08:35:06.8166667+00:00

This has already been shared above. Please update us with the results after testing.

{ "properties": { "displayName": "Weekly anomaly by resource group", "scope": "subscriptions/XXXXXXXXX", "status": "Enabled", "viewId": "/subscriptions/XXXXXXX/providers/Microsoft.CostManagement/views/ms:DailyAnomalyByResourceGroup", "schedule": { "frequency": "Weekly", "hourOfDay": 12, // Hour of day the alert should run "daysOfWeek": [1], // Set to Monday (1) to run weekly on Monday "weeksOfMonth": null, // No specific weeks of the month "dayOfMonth": 0, // Day of month, not needed for weekly "startDate": "2025-08-14T17:25:41.276Z", // Start date for the scheduled action "endDate": "2026-08-14T17:25:41.276Z" // End date for the scheduled action }, "notification": { "subject": "Cost anomaly detected in subscription", // Notification subject "message": "", // Message body, if needed "to": ["******@gmail.com"], // Email recipient "language": "en", // Language for the notification "regionalFormat": "en" // Regional format for the notification }, "notificationEmail": "******@gmail.com" // Notification email } }
Guha, Satyaki 20 Reputation points

2025-08-18T08:44:27.86+00:00

Its working, thanks everyone. To clarify I wasnt giving the correct viewId
Guha, Satyaki 20 Reputation points

2025-08-18T08:45:53.6566667+00:00

Its working thank you everyone
Naveena Patlolla 5,365 Reputation points Microsoft External Staff Moderator

2025-08-18T09:42:23.91+00:00

I have converted the comment into an answer. Can you please "Accept the Answer"

Answer 1

Hello Guha, Satyaki,

The issue likely due to incorrect URL construction or handling of the api-version parameter. The api-version parameter must appear after the question mark (?) in the URL as a query string. If it's incorrectly placed or omitted, as shown below, it results in a 400 Bad Request error.

User's image

I tested the scheduled action creation and update using Postman, and it worked as expected.

User's image

 https://management.azure.com/subscriptions/XXXXXXX/providers/Microsoft.CostManagement/scheduledActions/test-rule?api-version=2025-03-01


{
  "properties": {
    "displayName": "Weekly anomaly by resource group",  
    "scope": "subscriptions/XXXXXXXXX",  
    "status": "Enabled",  
    "viewId": "/subscriptions/XXXXXXX/providers/Microsoft.CostManagement/views/ms:DailyAnomalyByResourceGroup",  
    "schedule": {
      "frequency": "Weekly",  
      "hourOfDay": 12,                // Hour of day the alert should run
      "daysOfWeek": [1],              // Set to Monday (1) to run weekly on Monday
      "weeksOfMonth": null,           // No specific weeks of the month
      "dayOfMonth": 0,                // Day of month, not needed for weekly
      "startDate": "2025-08-14T17:25:41.276Z",  // Start date for the scheduled action
      "endDate": "2026-08-14T17:25:41.276Z"     // End date for the scheduled action
    },
    "notification": {
      "subject": "Cost anomaly detected in subscription",  // Notification subject
      "message": "",  // Message body, if needed
      "to": ["******@gmail.com"],  // Email recipient
      "language": "en",  // Language for the notification
      "regionalFormat": "en"  // Regional format for the notification
    },
    "notificationEmail": "******@gmail.com"  // Notification email
  }
}

User's image

Important: Ensure that the scope specified in the JSON payload matches the scope selected in the Azure Portal.

Please let me know if you face any challenge here, I can help you to resolve this issue further

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Guha, Satyaki 20 Reputation points

2025-08-21T15:45:39.3466667+00:00

Hello everyone, really appreciate your support in this. One final doubt I had is now that I have setup cost anomaly alert rules across all subscriptions, is there an established approach to maybe extract a consolidates report of detected anomalies across all subscriptions from the management group level?
Guha, Satyaki 20 Reputation points

2025-08-26T10:07:14.3366667+00:00

Hello everyone, is there a way to get a consolidated anomaly detection report at at the management group level across all subscriptions?
Vinod Pittala 6,310 Reputation points Microsoft External Staff Moderator

2025-08-28T11:57:05.3633333+00:00

Hello Guha, Satyaki,

Apologies for the delay in my response.

Usually, Azure cost management does support anomaly detection at the subscription level. However, consolidated reporting at the management group level is not natively supported as a single out-of-the-box feature. Instead, you can typically set up anomaly alert rules across individual subscriptions

or use PowerShell scripts or APIs to extract and aggregate anomaly data manually.

If the comment helpful, please click Upvote it.

Thanks

Share via

Cost Anomaly Detection setup through powershell script

0 additional answers

Your answer