API returns unknown VM's not set up by user

Question

API returns unknown VM's not set up by user

BenediktSnow 21

Using the endpoints

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines?
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ClassicCompute/virtualMachines?

sometimes there are included unknown VMs in the response, not set up by the user. They all have machine names consisting of 32 characters of a blend of lower case letters and numbers.

Any help on where these are coming from and how to filter these out is appreciated!

kobulloc-MSFT 26,861 Reputation points Microsoft Employee Moderator

2022-02-24T14:55:07.123+00:00
Hello, @BenediktSnow !

I'll have to double check (and I think I'll have to create some resources manually as this isn't typically called out in documentation) but there are a number of services that might create these types of resources on your behalf with the automatic naming convention that you are describing.

Does the resource group give any clues? Often autogenerated resources are either in the resource group with the service responsible or have a resource group created by the service with a similar name (and the resources within would give a good indication of why they were created).

Are there any services you are using that might have a compute component? DevTest Labs, Azure Kubernetes, Scale Sets, etc.?
BenediktSnow 21 Reputation points

2022-03-01T08:26:03.68+00:00

Hi. Thanks for the response. Sounds like there's a range of possible scenarios with auto generated resources.

I don't have access to the environment in question. But narrowing down the focus a little bit here, is there a universal way of telling if a resource was auto generated? This is for asset management / reporting purposes.
kobulloc-MSFT 26,861 Reputation points Microsoft Employee Moderator

2022-03-01T17:20:50.123+00:00
@BenediktSnow ,

No worries! I was hoping to give you a more concrete example but it looks like there are several variables that make this more difficult to reproduce on demand.

Are you able to view the Activity Log? That would be the first step in identifying what created a resource, moving on then to Log Analytics (my query skills are a bit rusty, the Azure Monitor tag might give you better results). This should get you pointed in the right direction:

Azure Monitor: Activity Log

Azure Monitor: Resource Logs
BenediktSnow 21 Reputation points

2022-03-02T09:01:07.943+00:00

Thanks again!

At this point my focus has shifted from trying to track down these specific resources, to wanting to know if there's a way to tell from the api response data if a VM was autogenerated, covering all scenarios. It looks like that is not possible at the moment?
kobulloc-MSFT 26,861 Reputation points Microsoft Employee Moderator

2022-03-04T04:19:57.333+00:00

@BenediktSnow ,

I think List under Monitor > Reference > Activity Logs may be what you are after as I didn't see anything under Compute. This makes sense if I'm reading this correctly as you would want a generalized approach to seeing how resources were created however I'm less familiar with this area.

https://learn.microsoft.com/en-us/rest/api/monitor/activity-logs/list

The sample response there includes a caller, role, and other identifying information that should give you what you are looking for however it will require some filtering.