Created Case 2604070040007111 yesterday over unauthorized charge. No one has contacted me and all SQL databases are disabled.

Question

I opened a case yesterday regarding an unauthorized transaction. I've been contacting Azure for the better part of the month asking them to explain to me why my usual invoice of $13/month went up to $376.

Nobody has replied or contacted me, and now they have disabled all my sql databases.

What can I do?

Answer 1

For an unexpected Azure charge followed by disabled SQL databases, the next steps are:

1. Investigate the unexpected charges
   • In the Azure portal, review the invoice and usage that led to the $376 charge:
     • Go to Cost Management + Billing → your billing account/profile → All transactions.
     • Filter by the latest invoice to see which products and SKUs generated the charges (for example, specific SQL databases, compute, storage).
     • Use Cost analysis to see which resources and subscriptions caused the spike and when it started.
   • If you still don’t recognize the usage or charges, follow the guidance under Unexpected usage or charges:
     1. Review the invoice that has charges for the resource.
     2. Review invoiced charges in Cost analysis.
     3. Find people responsible for the resource and engage with them.
     4. Analyze the audit logs.
     5. Analyze user permissions to the resource’s parent scope.
     6. If needed, create an Azure support request.
2. Escalate the billing dispute with Azure Billing Support
   • Billing support is free and is the correct path for charge disputes and subscription disablement tied to billing.
   • Create a dedicated billing support request (separate from any technical case) so a billing engineer can review and respond:
     1. Go to the Azure portal support creation page (for example, Help + support → Create a support request).
     2. For the problem type, choose Billing.
     3. Select the affected subscription.
     4. When the suggested solutions appear, ignore them and continue with Create a support request / Return to support request so the case is actually opened.
     5. In Additional details, include:
        • The invoice ID with the $376 charge.
        • The normal monthly amount ($13) and when the spike started.
        • The existing case number (2604070040007111) so they can link the cases.
   • After submitting, monitor email and the Azure portal Help + support area for responses.
3. Address disabled SQL databases
   • SQL databases can be disabled when a subscription is in a disabled or past-due state. Once billing issues are resolved and the subscription is reactivated, most Azure resources resume automatically, but there can be a delay of up to ~30 minutes.
   • After reactivation:
     • Verify the subscription state is Active.
     • Check each SQL database and, if needed, manually resume or restart it.
   • If more than 30 minutes pass after reactivation and databases are still unavailable, contact Azure Billing Support again using the same billing support channel.
4. If compromise or fraud is suspected
   • If the spike is due to unauthorized activity (for example, a compromised subscription):
     • Review Microsoft Entra sign-in logs and the Azure Activity Log for unusual activity around the time the charges increased.
     • Check for unauthorized resources and deallocate/remove them.
     • Immediately contact Azure support and report the incident as a potential compromise.
5. If this is a Microsoft account (non-Azure) charge
   • For non-Azure Microsoft account charges (for example, Microsoft Store or consumer subscriptions), go to the Manage your payments page of the Microsoft account dashboard and select Investigate for the unrecognized charge.
   • Use the Microsoft billing troubleshooter or contact Microsoft Customer Service to request investigation and possible refund.

These steps ensure both the billing dispute and the service disablement are handled by the correct Azure/Microsoft billing teams and that the root cause of the cost spike is identified.

---

References:

• Understand the terms in your Azure usage and charges file
• Tutorial: Review your Microsoft Customer Agreement invoice
• Reactivate a disabled Azure subscription
• Detect and respond to security alerts
• How to investigate a billing charge from Microsoft
• How to engage with Microsoft Operations
• Fraud Charges - Microsoft Q&A
• Can I speak to someone? -- Billing issues - Microsoft Q&A
• fraud charges on microsoft account - Microsoft Q&A