VM got deleted and No acitivity logs

Question

VM got deleted and No acitivity logs

syed 0

Hi,

We noticed that one of our VM and its resource group were deleted or terminated, and we could not find any trace in the activity logs to get more details, such as who deleted them and the date. We had some challenges with billing payments; is there anything related to that?

Andreas Baumgarten 133.1K Reputation points MVP Volunteer Moderator

2026-08-21T06:59:42.7866667+00:00

Hi @syed ,

did you check the Activity Log of the Azure Subscription as well?
If you delete a Resource Group this should be logged in the Activity Log of the Azure Subscription.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
syed 0 Reputation points

2026-08-21T09:08:58.99+00:00

The strange thing is, there is no log associated with the delete operation for RG and VM.
Andreas Baumgarten 133.1K Reputation points MVP Volunteer Moderator

2026-08-22T05:35:52.7733333+00:00

Hi @syed ,

my user is "Owner" in my Azure subscription and in the Action Log directly of the Subscription I can see the logged delete activities of resource groups and objects.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

1 answer

Your answer

Andreas Baumgarten 133.1K Reputation points MVP Volunteer Moderator

2026-08-21T06:59:42.7866667+00:00

Hi @syed ,

did you check the Activity Log of the Azure Subscription as well?
If you delete a Resource Group this should be logged in the Activity Log of the Azure Subscription.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
syed 0 Reputation points

2026-08-21T09:08:58.99+00:00

The strange thing is, there is no log associated with the delete operation for RG and VM.
Andreas Baumgarten 133.1K Reputation points MVP Volunteer Moderator

2026-08-22T05:35:52.7733333+00:00

Hi @syed ,

my user is "Owner" in my Azure subscription and in the Action Log directly of the Subscription I can see the logged delete activities of resource groups and objects.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Answer 1

Hello @syed ,

To clarify- Yes, it's related to billing.

If Azure disables your subscription for non-payment:

All VMs/resource groups become inaccessible
After ∼30-90 days disabled, Microsoft permanently deletes all resources by system process
That system delete often does not appear as a Delete operation in Activity Log with a user principal - it's a backend billing cleanup, and Activity Log only retains 90 days anyway.

Check: Portal > Subscriptions > Your subscription > Look for Disabled / Deprovisioned state and billing alerts. If that's the case, data is not recoverable.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.