Azure Open AI Cost spiked to 214K in 15 days, usual average was 4K per month

Prashant Yadvendra 0 Reputation points
2026-10-30T04:16:12.99+00:00

Our Azure Open AI cost using a 5.6-sol model deployed via Foundry has spiked from usual 4K per month to 214K . this is practically not possible.

Azure OpenAI in Foundry Models
0 comments

3 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Prashant Yadvendra 0 Reputation points
    2026-10-30T21:11:11.62+00:00

    I saw the usage broken by Model name, The 5.6 Sol which we use shows correct billing, for 6.1 which we provisioned for a trial and hardly have used for 7-8 queries is showing 180K. its showing use of 6.1 almost every day when we hardly used it for 1-2 days.
    Only two possibilities:

    1. Key leak
    2. Faulty Metering on 6.1

    User's image

    Was this answer helpful?

    0 comments
  2. Senthil kumar 2,995 Reputation points
    2026-10-30T07:12:26.0766667+00:00

    Hi @Prashant Yadvendra

    First Check the below points.

    1. A runaway application or automation loop
      • An application repeatedly calling the model due to a bug.
      • Retries without proper limits.
      • A background process stuck in a loop.
    2. Prompt or context explosion
      • Large conversation histories being sent with every request.
      • RAG systems returning huge document chunks.
      • Increased use of reasoning models that consume many more tokens than expected.
    3. Unexpected deployment usage
      • Another application, team, or service principal started using the same Azure OpenAI endpoint.
      • API keys were shared or leaked.

    Metering or billing anomaly

    • Less common, but possible.
    • Sometimes usage spikes can be investigated by Microsoft support if telemetry and application logs don't align with billed consumption. Please do the below analysis. Azure Cost Analysis   Go to:   Cost Management → Cost Analysis   Filter:   Scope = Subscription Service = Azure OpenAI / Azure AI Foundry Granularity = Daily   Look for:   The exact day the spike began. Whether the increase was gradual or a sudden jump. Break down by Meter   In Cost Analysis, group by:   Meter   Look for entries such as:   Input Tokens Output Tokens Cached Input Tokens Provisioned Throughput Units (if used)   This will tell you whether the spend is coming from token consumption or something else.   Check Azure OpenAI Metrics   Navigate to the model deployment and review:   Monitoring → Metrics   Useful metrics:   Processed Prompt Tokens Generated Completion Tokens Requests Tokens per Request   Questions:   Did request count increase dramatically? Did tokens per request increase dramatically?   That distinction helps identify whether you have:   More traffic Larger prompts Larger responses Query Diagnostic Logs   If diagnostic logging is enabled, run KQL queries in Log Analytics.   For example:   
        AzureDiagnostics
  | where ResourceProvider == "MICROSOFT.COGNITIVESERVICES"
  | summarize
  Requests=count(),
  PromptTokens=sum(todouble(promptTokens_s)),
  CompletionTokens=sum(todouble(completionTokens_s))
  by bin(TimeGenerated, 1h)
  | order by TimeGenerated desc
        This often reveals:   Which hours saw spikes. Whether requests originated from a particular app. Check Authentication   Review:   Managed Identities Service Principals API Keys   Look for:   Recently created applications. New deployments. Key exposure.

    Thanks.

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-10-30T04:17:12.62+00:00

    Immediately stop or restrict traffic to the gpt-5.6-sol deployment, then reconcile the charge by resource, meter, deployment, and token usage before submitting an Azure billing case for the unexplained amount.

    1. Contain further spend

    Choose the least disruptive action available:

    1. Pause application traffic to the deployment at the calling application, gateway, or routing layer.
    2. If the deployment is not currently required, delete it from Foundry after recording its configuration and exporting the relevant cost/usage evidence.
    3. If traffic must continue, reduce its assigned TPM:
      • Microsoft Foundry → Manage → Quota → Token per minute.
      • Open the deployment and edit its quota allocation.
      • Allow up to 15 minutes for the change to propagate. TPM/RPM quota limits throughput; they are not monetary spending limits.^1^

    The published 25-billion-token monthly usage tier for gpt-5.6-sol is not a cost cap. Usage tiers indicate levels above which response latency might vary; they do not prevent charges.^2^

    2. Identify exactly which meter produced the charge

    In the Azure portal:

    1. Open the affected Azure OpenAI resource.
    2. Select Resource Management → Cost analysis.
    3. Set the date range to the affected 15 days and choose Daily granularity.
    4. Change Group by to Meter and use a line chart.
    5. Record the meter names, quantities, costs, and the first day the increase appeared.
    6. Repeat at the resource-group or subscription scope:
      • Cost Management → Reporting + analytics → Cost analysis.
      • Filter Service tier to Azure OpenAI; filtering only by service might show Azure OpenAI under the broader Cognitive Services category.
      • Group first by Resource, then by Meter.^3^

    This distinguishes token inference from another charging mode or another Foundry-associated resource. Foundry solution costs can include multiple Azure services, not only the model endpoint.^3^

    Also inspect Cost Analysis → Smart views → Resources → Insights. Open any anomaly insight to see the daily change by resource group. Anomaly evaluation runs after billing data is available, so it should not be treated as real-time protection.^4^

    3. Reconcile billing against model telemetry

    Open the Azure OpenAI resource and either:

    • Azure portal → resource overview → Go to Microsoft Foundry portal → Tools → Metrics, or
    • Azure portal → resource → Metrics.

    Compare the spike period with these dashboard categories:

    • Tokens-Based Usage
    • HTTP Requests
    • PTU Utilization, if applicable
    • Fine-tuning, if applicable

    Break the data down by deployment and API operation where those dimensions are available. Look for a matching rise in input/output tokens or request count, retry storms, agent/tool loops, batch jobs, test pipelines, or an unexpected caller. Azure OpenAI supplies resource dashboards for these usage categories.^5^

    If diagnostic settings were not enabled before the incident, historical caller-level attribution might be unavailable: Azure records billing usage, but most user actions are not retrospectively logged. Preserve available application, gateway, activity, and identity logs now.^6^

    4. If the measured usage is unauthorized

    If token/request telemetry confirms real traffic that your applications cannot account for:

    1. Disable the affected application credential or identity assignment.
    2. For API-key authentication, rotate both keys safely:
      • Move production clients to one known key.
      • Azure OpenAI resource → Keys and Endpoint → Regenerate the unused key.
      • Update clients to the regenerated key and verify them.
      • Regenerate the other key.^7^
    3. Review repository secrets, deployment variables, API Management configuration, role assignments, and recent activity-log changes.
    4. Prefer managed identity over embedded API keys for the replacement configuration.

    Key regeneration invalidates the old key immediately, so rotating an actively used key without migrating clients first causes HTTP 401 failures.^7^

    5. Escalate the charge

    If meter quantities do not reconcile with Azure Monitor/application records—or a credit or billing correction is requested—create a billing support request:

    1. Azure portal → Help + support.
    2. Select New support request.
    3. Choose Billing and the affected subscription.
    4. Attach:
      • Resource ID and deployment name
      • Exact UTC start/end dates
      • Cost Analysis export grouped by resource and meter
      • Token/request metric screenshots or exports
      • Expected baseline and the 214K variance
      • Relevant application/gateway logs
      • Containment time and actions

    Azure billing and subscription support is available continuously for assistance understanding Azure usage.^8^

    Finally, configure Cost Management anomaly and budget alerts. These provide notification, not a native real-time dollar hard stop; enforce immediate protection through gateway request/token quotas or automated traffic blocking.^9^

    References

    1. Manage Azure OpenAI in Microsoft Foundry Models quota
    2. Azure OpenAI in Microsoft Foundry Models quotas and limits
    3. Plan to manage costs for Azure OpenAI in Azure AI Foundry Models
    4. Identify anomalies and unexpected changes in cost
    5. Monitor Azure OpenAI
    6. Understand the terms in your Azure usage and charges file
    7. Rotate API keys
    8. Manage costs and billing for your Azure resources
    9. Hi, is there any way put a limit and do a stop based on cost in Azure AI Foundry GPT model deployed ? - Microsoft Q&A
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    4 people found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.