I never setup snapshots but a week's worth of them suddenly appeared and used up all my spending limits

Question

I have been using my Azure environment for a few years now. I never setup snapshots for my disks intentionally because I have offsite backups for my data. However yesterday for the first time my spending limit went over, and I noticed there were 8 days of snapshots from the last week. I had to pay $50 bucks just to get everything back up again for a service I never setup (I have $100 monthly azure credits) I am monitoring now to see if they continue, but 3 questions:

1. If they are enabled, how do I turn them off?
2. Who set them up? Because I did not
3. How do I get a refund for the money I had to spend for something I didn't turn on?

Answer 1

Hi,

I recommend you do some investigation to gather more information about how/when the snapshots were created.

In the Azure portal, please navigate to your subscription -- Activity log blade. Click Timespan and select Last month. In the search box just above the items, enter snap

For each item, click the arrow on the left to expand it, then click on items to examine details. For example, you can see the user account that initiated create snapshot of a disk. Take a careful look at the information on JSON tab for important information such as IP address (ipaddr), appid, etc.

What user created/updated the snapshots? Did the request come from your IP address, or some other unknown address? What appid made the request?

Thanks.

-TP