Building a FinOps team: hire, buy a tool, or outsource?

For a company spending $20K to $300K a month on Azure, the choice depends on who will own the changes, not on who finds the waste. A tool finds. A hire owns, if they have authority and engineering time behind them. A managed service owns the loop without adding headcount. Hire when spend nears $1 million a year across several teams, or when cloud cost is a margin line.

Which problem are you actually trying to solve?

Most CTOs who ask this question have already seen the waste. Azure Advisor has a list. Someone exported a cost report last quarter. The problem is that nothing on the list moved.

FinOps work splits into four jobs, and the three options cover them very differently:

If your gap is in the first row, buy or switch on a tool. If it is in the bottom three, a tool will give you a better-looking version of the list you already ignore.

What does a FinOps engineer do all week?

A FinOps practitioner is the person whose job is to make cloud cost a number that engineering and finance both trust and act on. In a mid-market company that role usually covers:

• Cost reporting and allocation: making sure every dollar maps to a team, product or environment, and fixing the tagging when it does not.

• Commitment management: deciding how much to cover with reservations or savings plans, watching how much of each commitment is used, handling exchanges. (We covered the decision itself in reservations vs savings plans.)

• Anomaly triage: answering "why did the bill go up" before the CFO asks it.

• Chasing owners: turning a finding into a ticket in someone's sprint, and following up when it slips.

• Forecasting with finance: next year's budget, and the variance explanation every month.

The last two items take most of the week in a company without a platform team that has spare capacity. A good FinOps engineer spends a surprising amount of time negotiating for other people's engineering hours.

What does the role really cost?

We are not going to quote a salary figure. Published ranges for "FinOps analyst" and "FinOps engineer" disagree with each other by tens of thousands of dollars depending on the source and title, and none of them describes the person you would actually need. In our experience the people who are good at this are senior cloud engineers who learned finance, and they cost what senior cloud engineers cost in your market. Use your own compensation bands.

Then add the parts that do not show up in the offer letter:

• Recruiting time. The pool of people with both Azure depth and finance fluency is small.

• Ramp. The first two or three months go to learning your tenant, your billing agreement and your politics.

• Authority. A FinOps hire who reports into finance and has no say over engineering backlogs becomes a very well-paid reporting function.

• Concentration risk. One person holds the knowledge. When they leave, the practice leaves with them.

A worked example

Example, with illustrative numbers you should replace with your own. Monthly Azure spend: $60K. Assume 15% of that is recoverable in year one, which is an assumption for the arithmetic, not a benchmark.

• Year-one recoverable spend: $60K × 15% × 12 = $108K.

• Year two: lower, because the easy items are gone. What remains is ongoing hygiene and commitment management.

Put your fully loaded cost for a senior cloud engineer next to $108K. If the two numbers are close, the hire roughly pays for itself in year one and costs you money in year two. At $250K a month the same arithmetic gives $450K in year one, and the answer changes.

What does a FinOps tool do, and what does it not do?

The tool category ranges from free native tooling to commercial platforms. Microsoft Cost Management has no charge for Azure subscriptions and already gives you cost analysis, budgets, exports and anomaly detection at subscription scope. Azure Advisor lists cost recommendations alongside it. Commercial tools add multi-cloud ingestion, better allocation for shared resources such as Kubernetes clusters, richer dashboards, and in some cases automated commitment purchasing.

What tools do well: ingest, normalize, allocate, alert, recommend.

What they do not do is own anything. Microsoft's own role documentation makes the point without meaning to: Cost Management Reader and Cost Management Contributor can both view cost-saving recommendations, and neither can act on them without separate access to the resources. A tool with read-only access produces a list. Someone with write access and a reason to care still has to make the change.

A few things no tool can decide for you:

• Whether resizing a SQL database is safe the week before month-end close.

• Whether an "idle" VM is the disaster-recovery box someone set up two years ago.

• Which team's sprint absorbs the change, and who tells their manager.

• Whether the saving actually landed on the invoice.

Advisor's own documentation adds a caveat worth repeating: its VM savings figures are based on retail rates and do not account for reservations or savings plans you already own, so the listed savings may be higher than what is achievable. We wrote more about this gap in what Azure Advisor does not do.

Automated commitment purchasing is the one area where a tool without a human owner works reasonably well, because the decision is mostly arithmetic and the risk is bounded by the commitment term. Everything that touches a running workload needs a person.

What does a managed FinOps service do?

A managed service runs the loop from outside: find the waste, rank it by net dollar impact, assign each finding an owner, get an approval, make the change safely, and verify the saving on the next bill. It replaces the missing owner, not your engineers.

The honest downsides:

• An outsider does not know your architecture on day one. The first month is spent learning which resources are load-bearing.

• You still need one internal person who can approve changes and answer questions. If nobody inside can say yes, the service turns into another list.

• It requires access to your tenant. Ask exactly what kind before you sign. Our security page describes the model we use; the questions apply to any vendor.

Which option fits your company? A decision table

Microsoft's FinOps guidance says most organizations find it important to establish a FinOps team as they near $1 million in annual cloud spend, about $83K a month. The audience for this article sits on both sides of that line, which is why there is no single answer.

When is hiring the right answer?

Hire when most of these are true:

• Annual cloud spend is near or above $1 million and growing.

• More than a handful of teams deploy to Azure independently, and finance wants costs charged back to them.

• Cloud cost is part of cost of goods sold and moves your gross margin.

• You have a commitment portfolio large enough that coverage, exchanges and renewals are a monthly job.

• You can give the hire real authority: a seat in engineering planning and the ability to put work in other teams' backlogs.

If the last point is false, do not hire yet. Fix the authority question first.

When is a tool alone enough?

A tool alone works when someone already owns cost. That is usually a platform lead who treats spend as part of reliability, reviews it weekly, and has the standing to ask a product team for a change. In that company the tool removes toil. In a company without that person, the tool adds another dashboard nobody opens after the first month.

What can you do this week?

1. Pull the last three months in Cost Analysis and write down the monthly average. Multiply by 12 and compare it with the $1M line.

2. Count what Advisor already knows. This Resource Graph query (it is Microsoft's published sample) summarizes cost recommendations and their estimated savings across every subscription you can read:

AdvisorResources
| where type == 'microsoft.advisor/recommendations'
| where properties.category == 'Cost'
| extend
  resources = tostring(properties.resourceMetadata.resourceId),
  savings = todouble(properties.extendedProperties.savingsAmount),
  solution = tostring(properties.shortDescription.solution),
  currency = tostring(properties.extendedProperties.savingsCurrency)
| summarize
  dcount(resources),
  bin(sum(savings), 0.01)
  by solution, currency
| project solution, dcount_resources, sum_savings, currency
| order by sum_savings desc

AdvisorResources
| where type == 'microsoft.advisor/recommendations'
| where properties.category == 'Cost'
| extend
  resources = tostring(properties.resourceMetadata.resourceId),
  savings = todouble(properties.extendedProperties.savingsAmount),
  solution = tostring(properties.shortDescription.solution),
  currency = tostring(properties.extendedProperties.savingsCurrency)
| summarize
  dcount(resources),
  bin(sum(savings), 0.01)
  by solution, currency
| project solution, dcount_resources, sum_savings, currency
| order by sum_savings desc

AdvisorResources
| where type == 'microsoft.advisor/recommendations'
| where properties.category == 'Cost'
| extend
  resources = tostring(properties.resourceMetadata.resourceId),
  savings = todouble(properties.extendedProperties.savingsAmount),
  solution = tostring(properties.shortDescription.solution),
  currency = tostring(properties.extendedProperties.savingsCurrency)
| summarize
  dcount(resources),
  bin(sum(savings), 0.01)
  by solution, currency
| project solution, dcount_resources, sum_savings, currency
| order by sum_savings desc

3. Ask one question in your next staff meeting: who could approve resizing a production database today, and who would do the work? If there is no name, you have an ownership gap, and a tool will not close it.

4. Pick the row in the decision table that matches you, and decide by the end of the month.

If you want a quick read on where you sit before talking to anyone, the FinOps Score asks ten questions and needs no tenant access.

Frequently asked questions

At what Azure spend should a company hire a dedicated FinOps engineer?

Microsoft's FinOps guidance says most organizations find it important to establish a FinOps team as they near $1 million a year in cloud spend, roughly $83K a month. Below that, a full-time hire rarely pays for itself unless cloud cost is a gross-margin line, the company runs several clouds, or finance needs chargeback across many teams. Above it, a hire with real authority usually makes sense.

Can a FinOps tool replace a FinOps engineer?

No. A tool ingests billing data, allocates it, flags anomalies and lists recommendations. It does not decide whether a resize is safe, schedule the change into an engineering backlog, or check the next invoice. Microsoft's own role table shows that Cost Management readers and contributors can view recommendations but need separate resource access to act on them. Someone still has to own the result.

What does a managed FinOps service do that a tool does not?

A managed service runs the loop a tool leaves open: it ranks findings by dollar impact, assigns each one an owner, gets an approval, helps make the change safely and verifies the saving on the next bill. It replaces the missing owner, not the engineers. You still need one internal person who can approve changes and answer questions about the architecture.

Is the Azure native tooling enough for a mid-sized company?

For detection and reporting, often yes. Microsoft Cost Management has no charge for Azure subscriptions and covers cost analysis, budgets, exports and anomaly alerts, and Azure Advisor lists cost recommendations. Native tools fall short on ownership, approvals and verification, and on multi-cloud or Kubernetes cost allocation. The gap is usually a person or a process, not a missing dashboard.

Sources

• FinOps practice operations (Microsoft Learn, FinOps Framework)

• Understand and work with Cost Management scopes

• Identify anomalies and unexpected changes in cost

• Azure Advisor: VM and VMSS cost recommendations (limitations)

• Azure Resource Graph sample queries by category