Auto Shutdown event records

Question

Hello Team

In one of our VM auto Shutdown was applied without anyone permission by someone. Is it possible to track through which id that event got initiated as when i check activity log of that VM its just show VM deallocated and event initiated by azure lab services. It do not show through which ID auto shutdown was applied.

is it possible to track that id

Answer 1

View activity logs for auto shutdown updates as below:

1. On the home page for the VM, select Activity log from the left menu.
2. Remove the Resource filter, apply the appropriate Resource group filter, and view the entries for Add or modify schedules.
3. Select the Add or modify schedules operation to open a summary page that shows more details about the operation.

---

--please don't forget to upvote and Accept as answer if the reply is helpful--