## TL;DR
Check whether the alert is set on forecasted spend rather than actual spend; forecast-based alerts fire early by design, while the portal shows actuals. Open the budget's alert rules to see which threshold tripped. The mismatch is expected behavior, not a billing error.

## The error
```text
BudgetExceeded
```

## Fix it
1. Open Cost Management, then Budgets, select the budget, and open its alert rules.
   Expected: you see which rule fired and whether it is set on actual or forecasted cost.
2. Run a cost query for the budget period showing both actual and forecasted totals.
   Expected: forecast above the threshold while actuals sit below it, matching the portal.
3. Decide: keep the early warning, raise the forecast threshold, or switch the rule to actual-only if early warnings are not wanted.
   Expected: the team agrees on which behavior the budget should have.
4. Watch the next alert cycle.
   Expected: alerts now match expectations; no more surprise pages.

## Use this when
- A budget alert fires but the portal's current spend looks comfortably under budget
- The team wants to understand a BudgetExceeded notification before changing thresholds
- An agent pages on budget alerts and needs to tell real overruns from forecast warnings

## Not for this skill when
- Actual spend genuinely exceeds the budget (that is a real overrun; cut spend or raise the budget)
- The alert never fires at all (check alert rule configuration and notification contacts)
- The numbers disagree because of stale data (wait for the daily refresh, then compare again)

## Variant phrasings
- Azure budget alert fired but spend is lower
- forecast vs actual budget alert Azure
- BudgetExceeded false positive
- Azure budget alert on forecasted cost

## Why it happens
Azure budgets support two alert types: actual spend and forecasted spend. Forecast alerts exist to warn you before the money is gone, so they intentionally fire while actuals still look fine. The portal's headline number is actual accrued spend, which is why the two disagree by design.

## Edge cases
- Credits and refunds lower actuals but do not always lower the forecast the same way
- Multiple alert rules on one budget can stack; check all of them, not just the first
- Forecast accuracy drops early in the month when there is little data; early-month forecast alerts are the noisiest
- Alert emails can lag the data by hours; always compare against the same timestamp

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_S8XiFrSpTsBmiXmt_p5JBg