FinOps
Azure OpenAI cost and quotas: spend you can attribute
Azure OpenAI cost and quotas become manageable when every call carries a team or cost-centre key and hard stops exist before the invoice. Pexon sets TPM and RPM limits, Cap per team, and monthly attribution for industrial companies so FinOps can defend the budget without guessing which pilot burned the tokens.
What changes
Before and after attributable Azure OpenAI spend
| Question | Without attribution | With Cap and keys |
|---|---|---|
| What did team X cost? | Not answerable | A monthly figure per cost centre |
| Who hits the TPM limit? | Everyone fails together | The team that burned the Cap |
| Raise a department budget | Raise the whole subscription | Change one policy line |
| Forecast year two | Guess from the invoice total | Scale from measured tokens per case |
What actually drives the bill
Published model rates matter, but they are not where programmes lose control.
- Tokens attached per case — retrieval context and tool schemas grow with every useful integration.
- Turns per case — agent loops resend conversation history; chat demos understate this.
- TPM and RPM quotas — protect the platform, but do not assign blame or budget.
- Caching and batching — only count when engineering commits to shipping them.
A Cap is a policy, not a hope on the invoice
Azure OpenAI quotas keep one runaway job from starving the tenant. They do not tell FinOps which pilot to throttle. A Cap per team or cost centre refuses further spend when the budget is gone, even if the subscription still has headroom — which is the only way a budget conversation stays honest mid-month.
We usually enforce that Cap at a gateway that already tags every call. If your applications can tag natively and cost export already splits by tag, we use that instead of adding a component.
A quota without a team key is an outage switch. A Cap with a team key is a budget.
Where this connects
- Governance and Entra — the identities those team keys have to bind to
- LLM cost optimisation — caching and routing once spend is visible across models
- LLM gateway for Claude — the shared routing layer when Azure OpenAI is not the only provider
Questions buyers ask
Why is the Azure OpenAI invoice hard to defend?
Because without a team key on every call, tokens collapse into one subscription line. Quotas may stop a thundering herd, but they do not tell a budget holder which department caused it.
What is the difference between a quota and a Cap?
A quota is a platform limit on tokens or requests per minute. A Cap is a budget policy you enforce — often at a gateway — that refuses further spend for a team even when the subscription still has headroom.
Do we need a gateway for cost attribution?
If every application tags calls and you can export that tag into cost reporting, maybe not. Most estates cannot, which is why a LiteLLM-style gateway inside the tenant is the usual path to per-team figures.
How do you forecast before rollout?
Pick one real queue, measure tokens and turns on that workload, multiply by published rates, then apply caching only where engineering will actually ship it. Demo prompts produce demo forecasts.
Next step
Start with last month's unreadable line
A two-week blueprint at €4,900. We map who consumes Azure OpenAI today, set Cap and quota policy per team, and leave you with a monthly figure you can defend — not another slide about token prices.