Unexpected $12K Azure Bill from Startup Workloads—Can I Get a Credit or Refund?

The platform documentation indicates that Azure Firewall is deployed as part of creating the enclave's surrounding community or secure network environment. Bastion is also provisioned by default in the enclave-managed resource group to provide secure RDP access to administrative VMs. That explains why those charges appeared even though you did not explicitly deploy each service yourself.

Before trying again, review the exact startup-program workload criteria with support. A basic App Service, small database, container, or other low-cost resource may be sufficient, but do not assume that a resource counts until the program team confirms it. Also set budgets, spending alerts, and policy restrictions on expensive SKUs.

An enclave is more like a full secure-environment blueprint than a simple workload. It can provision the surrounding networking and security services automatically, including a firewall and related hub or policy resources. Those services continue generating charges even if the actual application workload is barely used.

Bastion is commonly enabled by default so administrators can securely access management VMs, although the exact deployment options may determine whether it can be removed. Check the managed resource group and deployment template before deleting anything, because some components may be tied to the enclave lifecycle.

For support, open an Azure Billing Support case and also contact your Microsoft for Startups representative if you have one. Explain that the resources were created for a program milestone, that the infrastructure scope was misunderstood, and that you have stopped or removed the resources. Include the subscription ID, billing period, resource-cost breakdown, deployment and deletion timestamps, and a clear request for a one-time goodwill credit. A refund is not guaranteed, but prompt action and detailed documentation give you the best chance.

This is worth treating as a billing-error or unintended-deployment case rather than just asking for a general refund. Export the invoice and cost-analysis details, identify every resource created by the deployment, and provide screenshots or activity-log records showing the automated provisioning. State that the resources were not used for production and were disabled as soon as the charges were discovered.

Azure support may decline some or all of the request because the services were technically provisioned and available, but Microsoft sometimes offers a discretionary credit for a first-time misunderstanding. Do not wait for the startup-program review before opening the billing case, since the billing team can at least document the incident and advise which program channel should handle the credit request.