Unauthorized resources were created

Question

Unauthorized resources were created

DevOps Developer909 0

Hello Team,

Unauthorized lab resource group was created and it's charging 21,000, Please help what i have to do it immediately.

Thanks

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-06-30T12:02:38.96+00:00
Hello DevOps, As per your query we understand that “Unauthorized lab resource group was created… charging 21,000”, it sounds like there may have been an unexpected/unauthorized deployment into your subscription/resource group. Here are the most useful Azure directions you can take immediately based on the provided docs.

1) Check whether creation was actually blocked or succeeded (Policy vs. “unauthorized”)

If your portal/deployments show errors like “Resource creation was disallowed by policy”, that points to an Azure Policy deny (not a user authorization issue). In that case:

Look up the denied policy assignment by reviewing the error details / activity log.

List policy assignments at the subscription scope:
az policy assignment list --scope /subscriptions/<subscription-id>

Review Activity log for the denied action:
az monitor activity-log list --status Failed --resource-group <resource-group-name>

Then work with your admin to adjust policy settings or request an exception if appropriate.

(If you don’t see a policy-deny message and resources truly exist, then it’s more likely a permissions/credential/identity issue and you’ll want to identify what identity created the RG and resources via Activity Log.)

2) If charges are related to cost management / unexpected items, trace the cost drivers

To understand what in that resource group is generating the cost:

Go to Cost Management + Billing → Cost analysis for the relevant scope.

Use Granularity = Daily or Monthly, and Group by Resource / Service to identify the exact resource(s) responsible.

If you want to mirror invoice-level details, use Invoice details view and correlate the charges to the responsible services/resources.

Also check Azure Activity Log for the user who made the most recent changes (this helps confirm who/what created the resources).

Consider opening an Azure support request (Billing)

If you need help quickly and the cost impact is urgent, you can submit a support request and specify the issue type as Billing. Kindly check the below documentation for more details: How to create an Azure support request - Azure supportability | Microsoft Learn

References (from provided documentation)

Troubleshoot common Cost Management errors (“Unauthorized” / create support request)

1 answer

Your answer

Answer 1

Immediately take the following actions:

Stop further charges by deleting the lab and its resources
If this is an Azure DevTest Lab or Azure Lab Services lab in a resource group you control:
- In the Azure portal, go to the lab resource.
- On the lab Overview page, select Delete from the top menu.
- On the confirmation page, enter the lab name and select Delete.
- Monitor progress in Notifications; deletion can take some time.
- After the lab is deleted, if the resource group was created only for this lab, delete the resource group as well:
  - Go to Resource groups in your subscription.
  - Select the resource group that contained the lab.
  - Select Delete resource group, confirm the name, and select Delete.
    Deleting the lab and then the resource group removes all lab-related resources and stops ongoing usage charges.
Ensure unauthorized resources are removed and prevented in future
- Regularly reconcile your Azure inventory and delete any unauthorized resources from the subscription.
- Use tags, management groups, and separate subscriptions to organize and track assets so unauthorized labs are easier to spot and remove.
- Use Azure Policy to restrict which resource types can be created (for example, only approved lab types) and Azure Resource Graph to discover any unapproved resources.
Investigate unexpected charges and who created the lab
- Review the invoice and usage for the subscription in Cost analysis to confirm that the charges are coming from this lab resource group.
- Analyze audit logs and user permissions at the subscription/resource group scope to identify who created the lab and how it was authorized.
- If needed, create an Azure billing support request (billing support is free) so a billing engineer can help investigate and explain the charges.
Engage billing support for charge review or adjustment
- Create a billing support request from the Azure portal (Help + Support → New support request, or via the support request creation link) and choose a billing-related problem type.
- Clearly state that an unauthorized lab resource group was created, list the subscription ID, resource group name, dates, and the approximate amount (21,000).
- Upload any screenshots of Cost analysis and invoices showing the charges.
- Billing support typically responds within one business day and can advise on possible credits or adjustments.
Strengthen governance to avoid recurrence
- Define and maintain an inventory of approved Azure resources and lab types.
- Use Azure Policy to monitor and block unapproved resources.
- Ensure only appropriate users have role-based access to create labs and resource groups.

These steps will stop ongoing charges by deleting the lab resources, help you understand and potentially dispute the existing charges, and reduce the risk of unauthorized labs in the future.

References: