1. **Budgets.** `az consumption budget create` per subscription/resource group: 80% warning to the team, 100% to the lead, forecast alert at 110%. Budgets do not stop spending; they start conversations early.
2. **Tagging policy.** Azure Policy: require `owner`, `env`, `costcenter` tags on creation (deny non-compliant). Untagged resources are unowned resources.
3. **Expensive defaults to fix:**
- Unattached managed disks and disassociated public IPs: billed, doing nothing. Periodic `az disk list --query "[?managedBy==null]"` cleanup.
- Stopped-but-not-deallocated VMs: still billed for compute. `az vm deallocate`, not `stop`.
- Premium SSD on dev disks, P1v3 plans for staging slots, always-on multi-region Cosmos for dev: right-size non-prod aggressively.
- Forgotten Log Analytics data ingestion: cap daily ingestion or retention bleeds money.
4. **Advisor.** `az advisor recommendation list` - act on the cost ones monthly; it finds idle VMs and oversized disks you forgot.
5. **Dev/test subscriptions.** Enterprise dev/test rates and auto-shutdown on dev VMs (`az vm auto-shutdown`). A dev box running 24/7 costs 3x what it should.
Traps:
- Budgets without action groups: the email goes nowhere and the surprise arrives anyway.
- Tagging policy in audit mode only: nice reports, zero enforcement. Use deny on the tags that matter.
Verify: month-over-month cost by tag trends down or tracks usage; budget alerts fire before the invoice, not after.