Cost Management
A Microsoft offering that enables tracking of cloud usage and expenditures for Azure and other cloud providers.
Fraudulent Claude usage on Azure AI Foundry - billing credit and source IP needed (case 2611090040009525)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 91%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPA%3C/text%3E%3C/svg%3E)
Philippe Abadie
5
Reputation points
Support case 2611090040009525 (Developer plan) asks us to continue here.
On November 2, 2026, between 06:00 and 17:00 UTC, an external party made about 22,000 calls to a Claude deployment in our Azure AI Foundry resource (USD 3,715.20). Nobody in our company made or authorized this usage. Our normal Claude usage was 13 calls in all of October.
We already contained it: keys rotated, deployment deleted, network restricted, keyless access with managed identity, diagnostic logs, rate limits and automatic shutdown. Full evidence is in the case.
We need:
- The Billing team to credit the USD 3,715.20 charge as fraudulent use (the case summary already says next step is a credit/refund by the billing team).
- The source IP and authentication method of the November 2 calls, from Microsoft service logs.
- A human support engineer to review the case; all replies so far were AI-generated.
Cost Management
Sign in to answer