AI cost allocation, budgets, and gateway token chargeback

Chapter 6 of 6

Confirm the result#

The module is complete when these checks pass:

1. Azure Policy shows the staged resource-group tag requirement and inherit-tag assignments at the approved subscription scope with the module marker.
2. The inherit-tag assignments have system-assigned managed identities and Contributor role assignments for remediation.
3. Cost Management shows the filtered budget with the approved actual and forecasted thresholds, email, and action group.
4. API Management emits the ai-finops-chargeback token metric with no more than five trusted custom dimensions, and the product quota returns the expected 403 or 429 response when exceeded.
5. The KQL query returns token rows grouped by cost center and consumer for the approved period and shows zero MissingTokenRows or a named owner reviewing them.
6. Finance accepts the rate table as the source for estimates and reconciles the estimate with Cost Management.

Stop if any result uses the wrong scope, a missing tag, an unapproved product, a client-supplied or user-level metric dimension, a missing token count with no owner review, or an unapproved rate.

After implementation#

Restore through the owning paths:

1. Return the APIM policy to the last approved version if token metrics or quota behavior break the route.
2. Disable or delete only the filtered AI budget after the cost owner confirms no automation depends on it.
3. Remove remediation tasks before removing inherit-tag assignments.
4. Remove only policy assignments whose metadata contains optional-module-ai-finops-token-chargeback.
5. Keep Cost Management, APIM, and telemetry records for their normal retention period.

Do not remove the Session 06 gateway route or the Session 11 observability baseline to roll back this module.