I logged into my Azure account after being away for some time and discovered that my credits had been used up along with an outstanding bill of roughly $55,000 for August 2026. My legitimate activity was limited to experimenting with AI models, and I deleted the resources I created. I found additional Azure AI Foundry resources that I do not recognize and removed them to prevent further charges. I suspect my account was compromised, especially because I have noticed suspicious activity on other accounts and am concerned that my email or laptop credentials may have been exposed. I have changed my passwords, frozen my payment cards, and contacted Azure Billing Support to report the usage as unauthorized. I'm a student with no income and cannot pay a bill of this size. Has anyone dealt with unauthorized Azure usage before, and were the charges reversed or waived after an investigation?
2 Answers
Your best path is to keep working directly with Microsoft Billing Support and clearly document everything: when you last used the account, which resources were yours, when you discovered the unfamiliar deployments, and when you deleted them. Ask them to investigate the activity as a possible account compromise and request that billing be paused or adjusted while the investigation is open. Also review every subscription, resource group, role assignment, service principal, API key, and activity log for anything unfamiliar. Turn on MFA, rotate credentials, remove unknown identities, and secure the email account and computer connected to Azure. There is no guarantee Microsoft will waive the charges, but prompt reporting and strong documentation are important.
Microsoft is the only party that can review the billing records or make an exception, so forum users cannot resolve the balance directly. Keep the support case open, provide the incident timeline and activity logs, and explain that you are a student who did not authorize the usage. Avoid creating more resources until the account is secured, and check whether any spending limits, budgets, alerts, or subscription restrictions can be added afterward. Treat this as both a billing dispute and a security incident.
I’ve already reported the activity to Billing Support, deleted the resources I didn’t recognize, changed my password, and frozen my cards. I’ll gather the logs and account timeline for the investigation.
Make sure MFA is enabled on the account itself and not just on another related service. If your email or device may have been compromised, secure those first and rotate any Azure secrets or access keys as well.