Cost Investigation

Explain a cost spike or unexpected charge. This skill focuses on what changed and why. For "what should I do about it" (right-sizing, cleanup, commitments) hand off to cost-optimization.

Note: The investigation uses cost data and Azure Resource Graph (resource inventory + change history) only — apply findings with normal change-control review.

All ARG queries below take subscription-id placeholders (<sub-id-1>, <sub-id-2>) — replace with the target subscriptions. To target a management group, first resolve member subs via ResourceContainers | where type == 'microsoft.resources/subscriptions' | where properties.managementGroupAncestorsChain has '<mg-name>' | project subscriptionId.

Run every ARG query through the generate → validate → execute workflow. The queries below are ready to run, but pass each one to validate_query first — it confirms the syntax and property paths before you spend a call on execute_query. If you need to adapt a query to a different resource type or field, draft it with generate_query (a natural-language prompt), then validate and execute.

Step 1: Find the Spike Window

Call query_costs with timeframe=MonthToDate, granularity=Daily on the user's scope. Identify the day(s) where daily cost jumped materially above the prior daily run rate. Report the spike date(s) and the magnitude ($ jump and % above baseline).

Step 2: Which Service Drove It

Run two queries to compare current month vs the same number of days in the prior month: