Building a Cost Visibility Dashboard with Azure Monitor Workbooks

Azure Monitor Workbooks are interactive reports that can combine data from multiple sources (Log Analytics, Azure Resource Graph, Azure Monitor Metrics, and Cost Management) into a single view. For teams that want to correlate cost trends with operational data, Workbooks provide more flexibility than the built-in Cost Management dashboards.

This post walks through building a cost visibility Workbook that surfaces resource group spend, Log Analytics ingestion costs, and a resource inventory, all consolidated in a single view.

1. Creating a New Workbook

1. Navigate to Azure Monitor > Workbooks
2. Select + New
3. The Workbook opens in edit mode with an empty canvas
4. Select Add > Add text to add a title and description section at the top

Workbooks are saved to a Log Analytics workspace or an Application Insights resource. Save early by selecting the Save icon and choosing a workspace, name, and category. Using the category Cost Management keeps cost-related workbooks discoverable.

2. Adding a Cost by Resource Group Tile

The first tile will show monthly spend by resource group using Azure Resource Graph, which supports querying billing data at scale.

1. Select Add > Add query
2. Set Data source to Azure Resource Graph
3. Enter the following query:

resourcecontainers
| where type == "microsoft.resources/subscriptions/resourcegroups"
| project resourceGroup = name, subscriptionId

For cost data specifically, add a Log Analytics query tile pointing to your workspace and use the AzureActivity or custom cost export data if you have ingested exports into Log Analytics.

Alternatively, use the Add > Add metric option to embed a Cost Management view directly as an iframe tile within the Workbook.

3. Adding a Log Analytics Ingestion Tile

1. Select Add > Add query
2. Set Data source to Logs and select your Log Analytics workspace
3. Enter the following query to show daily ingestion volume by data type:

Usage
| where TimeGenerated > ago(30d)
| summarize TotalGB = sum(Quantity) / 1024 by DataType, bin(TimeGenerated, 1d)
| order by TimeGenerated desc

4. Set the Visualisation to Bar chart
5. Set Size to Large

This tile gives a continuous view of which log sources are driving workspace cost, updated each time the Workbook is opened.

4. Adding a Resource Inventory Table

A resource inventory table helps identify resources that may be idle or oversized. Following is a Resource Graph query that lists all VMs with their size and location:

resources
| where type == "microsoft.compute/virtualmachines"
| project name, resourceGroup, location, vmSize = properties.hardwareProfile.vmSize, powerState = properties.extended.instanceView.powerState.displayStatus
| order by resourceGroup asc

Add this as a Grid visualisation tile. Columns can be formatted using the Column settings to highlight VMs in a stopped or deallocated state for follow-up.

5. Sharing the Workbook

Once the Workbook is complete, it can be shared in several ways:

• Pin to Azure Dashboard — select any tile and use the pin icon to add it to a shared dashboard
• Share link — Workbooks generate a direct URL accessible to anyone with the appropriate RBAC role
• Export as ARM template — allows the Workbook to be deployed consistently across multiple subscriptions via Infrastructure as Code

Navigate to the Workbook's toolbar and select Share to access these options.

Summary

Azure Monitor Workbooks provide a flexible canvas for combining cost, performance, and inventory data that would otherwise require switching between multiple portal blades. Building a shared cost visibility Workbook gives teams a consistent, always-current view of the metrics that matter most for cost governance.

Cross-Subscription Cost Analysis Using Azure Management Groups

Enterprise Azure environments typically span multiple subscriptions, separating production from non-production, isolating business units, or enforcing compliance boundaries. Analysing costs across these subscriptions individually is inefficient and makes it difficult to understand total organisational spend.

Azure Management Groups provide a governance layer above subscriptions that enables cost analysis, policy assignment, and role-based access control at scale. This post covers how to use Management Groups for cross-subscription cost visibility

1. Understanding the Management Group Hierarchy

A Management Group is a container that can hold subscriptions or other Management Groups. The hierarchy typically mirrors an organisation's structure. Following is an example:

Root Management Group
├── Platform
│   ├── Connectivity (subscription)
│   └── Identity (subscription)
├── Landing Zones
│   ├── Production (subscription)
│   └── Non-Production (subscription)
└── Sandbox (subscription)

Cost analysis scoped to a Management Group aggregates costs from all subscriptions within it, including nested groups. This means a query at the Landing Zones group captures both production and non-production spend in a single view.

Navigate to Management Groups in the Azure Portal to review the current hierarchy. If Management Groups have not been configured, this is a prerequisite before cross-subscription cost analysis is meaningful.

2. Assigning Cost Management Reader Role

To view costs at Management Group scope, the user or service principal needs the Cost Management Reader role assigned at the Management Group level.

1. Navigate to Management Groups > [your management group] > Access control (IAM)
2. Select + Add > Add role assignment
3. Search for and select Cost Management Reader
4. Assign to the appropriate user, group, or service principal

This role grants read-only access to cost and billing data without providing access to manage the underlying resources.

3. Analysing Costs at Management Group Scope

Once the role is assigned, cost analysis is available directly at the Management Group scope.

1. Navigate to Cost Management + Billing > Cost Management
2. In the Scope selector at the top of the page, select the Management Group
3. Open Cost Analysis

Following is the recommended configuration for a cross-subscription cost review:

• View: Accumulated costs
• Granularity: Monthly
• Group by: Subscription (to see per-subscription breakdown within the group)
• Time range: Last 6 months (to identify trends)

Switch Group by to Resource group or Tag: cost-center to further slice the aggregated spend.

4. Exporting Cross-Subscription Cost Data

Cost Management Exports are supported at Management Group scope, allowing automated delivery of cross-subscription cost data to a storage account.

Navigate to Cost Management > Exports with the Management Group selected as the scope, then create a scheduled export following the same process as subscription-scoped exports. The resulting CSV includes a SubscriptionId column, enabling downstream segmentation by subscription.

5. Common Pitfalls

Two issues frequently arise when working with Management Group cost analysis:

• Missing subscriptions: Subscriptions not placed under the Management Group hierarchy will not appear in the aggregated view. Verify that all relevant subscriptions are correctly placed.
• Currency mismatches: If subscriptions are on different billing accounts or currencies, the aggregated cost view may not reconcile directly with individual invoices.

Summary

Management Groups provide the most scalable approach to cross-subscription cost governance in Azure. Assigning the Cost Management Reader role at the Management Group level and scoping cost analysis accordingly gives finance and platform teams a single, consistent view of organisational spend, without requiring access to individual subscription resources.

Presentation - Start Secure, Stay Secure: Full-Lifecycle Application Security with Azure

I had the privilege of conducting a session at the Global Security BootCamp (Perth 2025)

Following is the presentation I conducted.

Following are few snaps from the event

Following is the official site of the event 

Optimising Azure Monitor Ingestion Costs: What to Log and What Not To

Azure Monitor Log Analytics is billed primarily on data ingestion volume. As environments grow and diagnostic settings are enabled across more resources, ingestion costs can increase significantly, often without a corresponding increase in the value derived from the data being collected.

Cost optimisation is a key pillar of the Azure Well-Architected Framework. This post outlines a structured approach to reducing Log Analytics ingestion costs without compromising on operational visibility.

1. Understanding Ingestion Pricing

Log Analytics uses a tiered pricing model. The Pay-As-You-Go rate applies to all ingestion above any commitment tier purchased. Commitment tiers (100 GB/day, 200 GB/day, and higher) offer significant per-GB discounts for workspaces with consistent, predictable ingestion volumes.

Before optimising individual log sources, it is worth reviewing the workspace's current daily ingestion volume to determine whether a commitment tier would reduce overall cost.

Navigate to Log Analytics workspace > Usage and estimated costs to see the current daily ingestion volume and a comparison of what each commitment tier would cost at that volume.

2. Identifying High-Volume Log Sources

The first step in any ingestion optimisation exercise is understanding where the data is coming from.

Following is a KQL query to rank data types by ingestion volume:

Usage
| where TimeGenerated > ago(30d)
| summarize TotalGB = sum(Quantity) / 1024 by DataType
| order by TotalGB desc

In most environments, a small number of data types, typically AzureDiagnostics, SecurityEvent, or Syslog, account for the majority of ingestion. Focus optimisation effort on these sources first.

3. Reviewing Diagnostic Settings

Diagnostic settings control which log categories and metrics are sent from Azure resources to Log Analytics. Many resources have categories enabled by default that are rarely queried in practice.

Navigate to any Azure resource > Diagnostic settings and review the enabled categories. Common categories that can often be disabled without impacting operations include:

• AuditEvent logs for services with low change frequency
• AllMetrics when the same data is already available through Azure Monitor Metrics at no additional cost
• Verbose activity categories on services such as Azure API Management (GatewayLogs at DEBUG level)

Disabling a single verbose category on a high-throughput service can reduce ingestion by several gigabytes per day.

4. Using Data Collection Rule Transformations to Filter

Data Collection Rules (DCRs) support ingestion-time transformations using KQL. This allows specific rows or columns to be filtered out before they are written to the workspace, reducing billable ingestion volume.

Following is an example transformation that filters SecurityEvent rows to retain only events with EventID in a defined allow-list:

source
| where EventID in (4624, 4625, 4648, 4720, 4726)

Navigate to Azure Monitor > Data Collection Rules, select the relevant DCR, and open the Data sources tab to configure the transformation on the applicable data source.

5. Setting Table-Level Retention

Not all data needs to be retained in the hot (interactive) tier for the same duration. Log Analytics supports per-table retention settings, with data beyond the interactive period moving to low-cost archival storage.

Navigate to Log Analytics workspace > Tables, select a table, and choose Manage table to configure the interactive retention period. For high-volume, low-query-frequency tables such as AzureDiagnostics, reducing interactive retention from 90 days to 30 days can meaningfully reduce workspace cost.

Summary

Reducing Log Analytics ingestion costs requires understanding the workspace's data profile before making any changes. Identifying the top ingestion sources, reviewing diagnostic settings for unnecessary categories, applying DCR transformations to filter noisy data, and right-sizing table retention periods are the four most impactful levers available, none of which require compromising on the logs that matter.