"Anomaly" in sql billing

Question

I decided I didn't want to have a staging deployment between my development app service and my production app service. I deleted the staging database. It came back a few days later. I didn't notice, but it came back at a higher level, and I ended up with an extra $300 on my monthly bill. I deleted the database and got a refund. The database came back a few days later at the higer level. I discovered it after I got the invoice. I deleted it. It came back a few days later. I finally deleted the SQL service, as opposed to the database, and it didn't come back. Trying to get a refund, I had to pay $30 a month just to get billing attention to it. They got me on the phone with a tech guy who insisted that it was impossible that Azure would do this, and yet there's absolutely no way I would do it. THREE TIMES. No one else has access to my subscription. We did, though, look at the activity log and find out that it was the admin for the service that had done the update. So then I deleted the service as opposed to the database, and it stopped coming back. Billing got a hold of the tech information and said we'll give you a partial refund. I said sure, and then I canceled my support to get back to free support. It's probably not worth pursuing this with Microsoft, and I wouldn't even know how, but I thought I'd ask about it here.

Answer 1

I tried to reopen the billing case. Would not re-open. I tried to submit a new one, and I kept getting the AI-generated answer, and was never given the option to open a support ticket. That happened four times. That's why I paid the $30 to get developer levle support, so at least someone would pay attention to me. I have submitted every little piece of evidence, of the DB's getting deleted and coming back. and the tech guy may have submitted more. I don't know how to get these people to pay attention. I don't know how to get them to evaluate the evidence separately from the tech guy saying "it's not our fault". My sense this needs to get escalated, and I don't know how to do that. I asked billing to do it, and they just said, "Here's our offer (short $40)." I said, "Not good enough." They went to the tech guy. The tech guy and I talked. We discovered the admin for the server had been the caller for the "updates" that added the expensive DBs. The tech guy told billing what he learned. I got the partial refund offer again. Lather, rinse, repeat. The anomaly is that there's absolutely no business reason on Earth why I would have done that, and no one else has access to my account. I can't believe I'm being haunted by something that wants me to go through this three times in a row. Since I don't believe in ghosts, I believe it's something that happened at Azure. They insist that's absolutely impossible. So it must be my responsibility.

Answer 2

Azure billing support is free, so reopen the matter as a Billing → Refund Request and attach the Activity Log records and deployment correlation details for all three database recreations; a paid technical-support plan is not required for billing cases.^1^

Reopen the billing case

1. In the Azure portal, select ? → Help + Support.
2. Describe the issue, then select Create a support request.
3. Select:
   • Issue type: Billing
   • Problem type: Refund Request, if available
   • The subscription on which the charges occurred
4. If recommended solutions appear, select Return to support request, then Next.
5. In Additional details, provide:
   • The original billing and technical case numbers.
   • The database name, SQL logical server, resource group, and subscription.
   • The UTC timestamps of each deletion and recreation.
   • The old and new database SKU/service tier.
   • The invoice line items and amount disputed.
   • The Activity Log caller, operation name, correlation ID, and JSON/CSV export for each event.
   • A concise timeline showing that deleting the database was followed by repeated recreation, while deleting the parent SQL server ended the behavior.
   • The partial-refund decision, while requesting review of the remaining amount.
6. Submit the request. Creating it requires subscription-level Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission.^1^

Refund approval remains case-specific. Accepting a partial refund may affect what billing can reconsider, but the available documentation does not define that policy.

Preserve the audit evidence now

The Activity Log records Azure control-plane create, update, and delete operations. It is also the location that records the resource creator, but its default retention is only 90 days.^2^

Go to Subscriptions → your subscription → Activity log, set the time range around each incident, and filter by:

• Resource type: SQL databases
• Operation: Create, Write, Update, or Delete
• Event initiated by: the identity shown previously
• Resource group/resource: the affected staging resources

Open each event and save:

• Download as CSV
• The event JSON
• Caller or initiating identity
• Operation name and status
• Timestamp
• Correlation ID
• Resource ID

The displayed “admin” identity identifies the caller recorded for the operation; by itself, it does not establish that Azure independently recreated the database. The event JSON, correlation ID, and related deployment are needed to distinguish a user, service principal, managed identity, automation process, or resource deployment.

If the events are still within 90 days, configure an Activity Log diagnostic setting to send future records to Log Analytics or another supported destination for longer retention.^2^

Trace what redeployed the database

Check Resource groups → affected resource group → Deployments. Open deployments at each recreation time and capture their operations and correlation IDs. Azure Resource Manager deployment history shows which resources a deployment created, and its correlation ID can be supplied to support to trace related events.^3^

This is particularly important if the App Service or environment was originally provisioned through an ARM/Bicep template, pipeline, or another automated deployment. An earlier successful deployment can recreate resources when explicitly redeployed; Azure’s rollback feature, for example, redeploys an earlier deployment with its original parameters rather than merely undoing a failed change.^4^

If the deployment record identifies an automation identity, inspect and disable the corresponding deployment source rather than relying only on deletion of the child database.

Prevent another delayed discovery

Configure an anomaly alert:

1. Azure Home → Cost Management
2. Select the subscription scope.
3. Select Cost alerts → + Add.
4. Choose Anomaly.
5. Enter recipients and create the rule.

This requires Cost Management Contributor or greater, or the Microsoft.CostManagement/scheduledActions/write permission. Anomaly detection evaluates subscription costs daily and can notify you of unexpected usage changes, although detection is not immediate.^5^

Also create a low monthly budget with multiple thresholds. Budget alerts and anomaly alerts serve different purposes: budgets catch fixed spending limits, while anomaly alerts detect unusual changes relative to prior usage.^6^

---

References

1. Create an Azure support request
2. Activity log in Azure Monitor
3. View deployment history with Azure Resource Manager
4. Rollback on error to successful deployment
5. Identify anomalies and unexpected changes in cost
6. Use cost alerts to monitor usage and spending