Azure Anomaly Detector retires Oct 1, 2026. Here is how to keep per-team cost-spike alerts.

If you built Azure cost-spike detection on Azure AI Anomaly Detector, you have both a deadline and a gap to plan around. Microsoft's own Anomaly Detector lifecycle page sets the date: the service retires on October 1, 2026, and creating new Anomaly Detector resources has been disabled since September 20, 2023. After the retirement date, the endpoints, models, and configurations are gone.

Microsoft's migration guidance sends general time-series workloads to Microsoft Fabric. But a huge real-world use of Anomaly Detector was narrower: detecting Azure cost spikes per team or per resource group before month-end. For that, Fabric is a lot of machinery for one question: did any team's daily cost just jump? And the obvious native fallback has a hole.

The hole: Azure cost anomaly detection is subscription-scope only

Azure Cost Management does ship built-in anomaly detection, but read Microsoft's own documentation carefully. The page Identify anomalies and unexpected changes in cost states plainly that "anomaly detection is only available for subscriptions." That single line is the gap:

• Subscription scope only. A spike inside one team's resource group is averaged into the subscription total. A team that quietly doubles its spend can be invisible in the subscription number.
• Rule cap. Native anomaly alert rules are limited per subscription, so you cannot give every team, environment, or cost center its own detector and its own recipient.
• Wrong recipient. A subscription-level alert does not reach the team that actually owns the runaway resource group and can fix it.

So after October 2026 you lose Anomaly Detector, and the native cost feature that remains will not alert you per team or per resource group. Here is a small, native way to close that gap.

The build: per-slice daily cost-spike detection

Pull daily actual cost per slice from the Cost Management query API, grouped by resource group or a tag key:

POST https://management.azure.com/subscriptions/{subId}/providers/Microsoft.CostManagement/query?api-version=2023-11-01

{
  "type": "ActualCost",
  "timeframe": "Custom",
  "timePeriod": { "from": "2026-07-01", "to": "2026-08-27" },
  "dataset": {
    "granularity": "Daily",
    "aggregation": { "totalCost": { "name": "Cost", "function": "Sum" } },
    "grouping": [{ "type": "TagKey", "name": "Team" }]
  }
}

Follow nextLink paging or you will silently truncate large tenants.

The one gotcha that will ruin your week: cost-data latency. Cost Management actuals for the most recent one to three days are incomplete and get restated as usage is ingested. If you judge yesterday against a full baseline, the newest day reads artificially low, and then every morning it "spikes" as it settles. Trim the most recent two days from both the judged day and the baseline:

const LATENCY_DAYS = 2;           // newest days are still settling
const judged = daily.at(-1 - LATENCY_DAYS);           // today - 2
const baseline = daily.slice(0, -1 - LATENCY_DAYS);   // trailing window before it

const mean = avg(baseline);
const sd = stddev(baseline);
const z = sd > 0 ? (judged - mean) / sd : 0;

const isAnomaly =
  baseline.length >= 3
    ? (z >= 3 && (judged - mean) >= 10)   // z-score + a dollar floor to kill noise
    : judged >= mean * 1.5;               // short-history fallback: percent jump

Then rank anomalies by dollar delta and post to the owning team's Teams channel with slice name, latest cost, baseline, delta, and z-score. Do not alert brand-new slices with under three days of history.

That is the whole idea: per-slice trailing baseline, latency trim, a z-score with a dollar floor, and a short-history fallback.

If you would rather not maintain it

Disclosure: I work for Katabarwa Labs, and we ship one app that does exactly this, Cost Spike Sentinel. It is one option next to the code above, not the only way.

It deploys into your own subscription as a managed application (runs entirely in your tenant), checks daily cost per resource group or per tag (Team, CostCenter, Environment) against its own trailing z-score baseline, handles the latency trim, falls back to percent-jump for short history, and alerts the owning team in Teams. Two honest caveats: it is alert-only (no write permission at all, it never caps or stops anything), and it replaces the cost use case, not all of Anomaly Detector (for general time-series, look at Fabric).

Listing: https://marketplace.microsoft.com/en-us/product/azure-application/katabarwalabs.cost-spike-sentinel

Takeaway

Do not let the October 2026 Anomaly Detector retirement quietly remove your cost-spike safety net, and do not assume the native Cost Management feature covers the gap: by Microsoft's own docs it is subscription-scope only. Decide now between native subscription alerts, the per-slice detector above, or a packaged one. What matters is that a runaway deployment gets noticed in a day, by the team that owns it, instead of at month-end by finance.