Azure Policy is powerful for cost governance, but the effect/mode combination trips people up. A `deny` effect on a tagging policy blocks deployments, which sounds useful until it starts blocking automated pipeline deployments at 2am because a Bicep template missed a required tag parameter. Starting with `audit` mode, building a baseline of violations, then moving to `deny` in a phased rollout by resource group or subscription is a much safer path and it gives you data on the blast radius before you enforce anything.
Budget alerts also have a timing limitation worth understanding: they check once per day, and spending data in Cost Management has a 24–48 hour lag for many resource types. A budget set at 100% of monthly spend can be breached and the alert still fires after you've already gone 20% over. Setting thresholds at 80% and 95% not just 100% gives you an earlier warning and time to act.
The other gap in policy-based governance is that it controls what gets created going forward but does nothing about historical waste. An old dev environment with 10 managed disks attached to deleted VMs won't violate any policy because it was provisioned before the policies existed. That's where https://prunr.cloud/ is useful it scans your existing subscription state and identifies orphaned resources, oversized VMs, and RI gaps with the exact monthly savings.
