Log analytics query to fetch any delete operations at azure subscription level

Hello,

When Activity logs are exported to a Log Analytics Workspace (via Diagnostics Settings), the records are ingested in the table AzureActivity in the specified Log Analytics Workspace. (off-topic - you can ingest this type of data for free)

Now, to find all AzureActivity records that involves Delete operations, you can run this Kusto Query:

AzureActivity
| where OperationNameValue contains "delete"

For many operations, you might have a record when the operation is started and one with the status (success, failed,etc.)

If you want to see all the delete operations that completed successfully, you can run:

AzureActivity
| where OperationNameValue contains "delete"
| where ActivityStatusValue == "Success"

If you need a Kusto Query that presents just some info about the delete operations (to use as a source for report / dashboard / alert rule), you can use this:

AzureActivity
| where OperationNameValue contains "delete"
| where ActivityStatusValue == "Success"
| extend Temp = split(_ResourceId,'/')
| extend Deleted_Resource = Temp.[-1]
| extend Deleted_ResourceType = Temp.[-2]
| project TimeGenerated, Caller, CallerIpAddress, Deleted_Resource, Deleted_ResourceType, ResourceGroup
| order by TimeGenerated desc

I hope this is the answer you're looking for (if so, don't forget to mark as an answer).

Thank you!

BR,

George