Most shocking Azure bills come from the same place: nobody treated spend as a design decision. The cloud did exactly what it was told. It was told to run a lot of oversized things, and nothing pushed back.
When cost arrives as a monthly surprise, it usually means affordability was an afterthought. Someone sized for peak load "to be safe." Environments got stamped out at one size whether they needed it or not. A proof-of-concept quietly became production and kept its generous footprint. Each of those is a governance gap. The price list was never the problem.
The fix isn't a cost-cutting project after the bill lands. Those are painful and late. The cheaper habit is to make cost a property of the platform, built in from the start. Three things do most of the work.
Budgets that warn you early. A subscription budget with an alert at 80% turns a runaway month into an email while you can still act. It's a few lines of Terraform. I wrote that one up in Never get surprised by the Azure bill.
Guardrails on what can be created. A policy that restricts VM sizes stops someone spinning up a monster machine for a job that needed a small one. The affordable option becomes the default, and the expensive one becomes a deliberate, visible choice rather than an accident.
Tags that make spend attributable. If every resource carries an owner and a cost centre, "what did we spend on this product, and who owns it?" is a query rather than an investigation. Enforce them as code so they can't be skipped. Untagged Azure resources covers the how.
For a leader, the test is simple. Ask your team whether they can answer what you spent on a given product last month, and who owns that number, in minutes rather than weeks. A confident answer means you have cost governance. Hesitation means you have a bill waiting to surprise you.
This is the Well-Architected cost pillar in practice. The goal is plain: spend on purpose, and be able to see and defend every pound. Right-size deliberately, put cost guardrails in the same policy layer as your security ones, and treat cost as something that ships with the platform rather than a clean-up crew that visits afterwards.
Cloud cost is an output of the architecture. Design for it, and the invoice stops being a surprise.
Next: the five questions a non-technical leader can ask to tell whether their cloud estate is actually under control.