Azure Activity Log is a subscription-level dataset of operations performed on Azure resources through Azure Resource Manager. It helps identify who did what, when, and on which resource. section 9.1.2
Investigating a deleted virtual machine
When a production VM disappears, filter the Activity Log in the Azure portal to investigate the deletion and identify the initiating identity. section 9.1.2
Use the Azure portal to narrow and inspect activity:
- Sign in, open Monitor, and select Activity Log. section 9.1.2
- Choose a timespan, such as the last 24 hours or two weeks. section 9.1.2 section 9.8
- Add a Resource Type filter, such as Virtual Machines, or filter by an operation. section 9.1.2 section 9.8
- Open an event to inspect its summary, operation name, and initiating identity. section 9.8
Reviewing storage key access
Filter Operation for List Storage Account Keys (Microsoft.Storage/storageAccounts/listkeys/action), select a result, and inspect who initiated it. section 9.8
Activity Log events remain available for 90 days. Configure diagnostic settings to stream them elsewhere when longer retention is required. section 9.1.2
