Agent Foskett Case File • Microsoft Azure • Azure Activity Log • AzureActivity • Resource Deletion • Cloud Investigation
The Azure Resource Was Deleted — The Activity Log Still Knew Who Did It
The resource was there yesterday.
Today it was gone.
No workload logs remained on the resource itself.
There was nothing left to inspect inside it.
The first question was obvious:
Who deleted it?
But Agent Foskett asked another question first.
What evidence survives when the resource does not?
The Resource Was Gone. The Evidence Wasn't.
Azure control-plane activity can preserve evidence about management operations even after the target resource has disappeared. The investigation starts with the deletion event, then expands into the caller, scope and surrounding changes.
✓ Find the delete operation
✓ Identify the caller and scope
✓ Reconstruct the control-plane timeline
The missing resource was not the end of the investigation
When an Azure resource disappears, investigators can lose the workload-level evidence that existed inside it.
But deleting a resource is itself a management-plane action.
Agent Foskett therefore moved away from the missing resource and toward the control plane.
The resource could no longer tell him what happened. The Activity Log could tell him how it disappeared.
But deleting a resource is itself a management-plane action.
Agent Foskett therefore moved away from the missing resource and toward the control plane.
The resource could no longer tell him what happened. The Activity Log could tell him how it disappeared.
Start with AzureActivity
Where Azure Activity Log data has been exported to a Log Analytics workspace, the
AzureActivity table provides a practical KQL starting point. Agent Foskett searched for successful delete operations around the affected resource.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith "/delete"
| where ActivityStatusValue =~ "Success"
| project TimeGenerated,
OperationNameValue,
ActivityStatusValue,
Caller,
CallerIpAddress,
ResourceId,
ResourceGroup,
SubscriptionId,
CorrelationId
| order by TimeGenerated descThe operation name established what Azure recorded
Agent Foskett preserved the exact
The provider and operation path help identify what kind of Azure management action occurred.
The exact operation is evidence. Keep it intact.
OperationNameValue rather than reducing the event to the word “deleted.”The provider and operation path help identify what kind of Azure management action occurred.
The exact operation is evidence. Keep it intact.
Scope the search to the missing resource
A subscription may contain many legitimate delete operations. Once the resource identifier was known, Agent Foskett narrowed the timeline to that specific Azure resource.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
let Resource =
"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-production/providers/Microsoft.Storage/storageAccounts/prodstorage01";
AzureActivity
| where TimeGenerated > ago(7d)
| where ResourceId =~ Resource
| project TimeGenerated,
OperationNameValue,
ActivityStatusValue,
Caller,
CallerIpAddress,
ResourceId,
CorrelationId,
ActivitySubstatusValue
| order by TimeGenerated ascWho — or what — initiated the deletion?
The
But Agent Foskett did not assume that every caller represented a human administrator. Azure management operations may be performed through users, applications, service principals, managed identities, automation and other authorised mechanisms depending on the environment.
Identify the caller first. Attribute intent only after correlation.
Caller field became one of the most important pivots in the case.But Agent Foskett did not assume that every caller represented a human administrator. Azure management operations may be performed through users, applications, service principals, managed identities, automation and other authorised mechanisms depending on the environment.
Identify the caller first. Attribute intent only after correlation.
The source IP was context, not a verdict
CallerIpAddress can add useful context when it is populated. Agent Foskett compared it with expected administration paths and other activity by the same caller.But an IP address alone does not prove who was physically behind an action. Proxies, cloud services, automation and other infrastructure can affect the observed source.
Use the IP to enrich the timeline, not to replace it.
CorrelationId connected related operations
A deletion may be surrounded by multiple control-plane records. Agent Foskett used the event's
CorrelationId as another pivot to find activity associated with the same operation sequence.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
let Correlation =
"11111111-2222-3333-4444-555555555555";
AzureActivity
| where TimeGenerated > ago(7d)
| where CorrelationId =~ Correlation
| project TimeGenerated,
OperationNameValue,
ActivityStatusValue,
Caller,
CallerIpAddress,
ResourceId
| order by TimeGenerated ascWhat happened before the delete?
The deletion event answered only one part of the case. Agent Foskett widened the time window around the resource to look for writes, configuration changes and other management operations immediately before it disappeared.
A suspicious sequence might include changes followed by deletion. A legitimate sequence might align with a planned decommission or deployment workflow.
The event mattered. The sequence gave it meaning.
A suspicious sequence might include changes followed by deletion. A legitimate sequence might align with a planned decommission or deployment workflow.
The event mattered. The sequence gave it meaning.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
let ResourceName = "prodstorage01";
AzureActivity
| where TimeGenerated > ago(24h)
| where ResourceId has ResourceName
| project TimeGenerated,
OperationNameValue,
ActivityStatusValue,
Caller,
CallerIpAddress,
ResourceGroup,
ResourceId,
CorrelationId
| order by TimeGenerated ascDid the caller touch anything else?
If the caller was unexpected, Agent Foskett expanded the investigation beyond the deleted resource. He searched for other successful management operations performed by the same caller during the surrounding period.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
let SuspectCaller = "admin@contoso.com";
AzureActivity
| where TimeGenerated > ago(7d)
| where Caller =~ SuspectCaller
| where ActivityStatusValue =~ "Success"
| project TimeGenerated,
OperationNameValue,
ResourceGroup,
ResourceId,
CallerIpAddress,
CorrelationId
| order by TimeGenerated ascA permitted action can still require investigation
If the caller had Azure RBAC permission to delete the resource, that established capability — not necessarily legitimacy.
Agent Foskett still needed to determine whether the action matched an approved change, deployment, decommissioning task or automation workflow.
Permission explains how an action was possible. It does not explain why it happened.
Agent Foskett still needed to determine whether the action matched an approved change, deployment, decommissioning task or automation workflow.
Permission explains how an action was possible. It does not explain why it happened.
Deletion does not mean every trace survives forever
The Activity Log is valuable because it records subscription-level control-plane events, but investigators should not assume telemetry will remain available indefinitely or that every data-plane action will appear there.
Retention, export configuration and the type of operation all matter.
For long-term hunting and correlation, organisations can route relevant Azure Activity Log data to destinations such as a Log Analytics workspace.
Evidence is most useful when retention is planned before the incident.
Retention, export configuration and the type of operation all matter.
For long-term hunting and correlation, organisations can route relevant Azure Activity Log data to destinations such as a Log Analytics workspace.
Evidence is most useful when retention is planned before the incident.
Investigation principle: Preserve management-plane telemetry independently of the resources it describes.
Control plane and data plane are different questions
Azure Activity Log is primarily about management operations on Azure resources. It should not be treated as a universal record of every action performed inside every service.
If the investigation also needs to establish who read data, queried a database or accessed objects inside a service, Agent Foskett would pivot to the appropriate service-specific or data-plane telemetry.
Know which plane your question belongs to before choosing the log.
If the investigation also needs to establish who read data, queried a database or accessed objects inside a service, Agent Foskett would pivot to the appropriate service-specific or data-plane telemetry.
Know which plane your question belongs to before choosing the log.
Build the deletion timeline
Agent Foskett organised the evidence chronologically.
Resource existsEstablish the last known point at which the Azure resource was present.
Pre-delete activityReview control-plane changes immediately before deletion.
Delete operation recordedPreserve the exact operation, status, resource ID and timestamp.
Caller identifiedDetermine the identity or mechanism associated with the management operation.
Related activity scopedPivot through CorrelationId, caller and surrounding resources.
Deletion explainedCorrelate the evidence with approved change, automation or suspicious activity.
What Agent Foskett checked
OperationWhat exact Azure management operation was recorded?
StatusDid the deletion succeed, fail or produce related records?
CallerWhich identity or mechanism initiated the operation?
Resource scopeWhich subscription, resource group and resource ID were affected?
CorrelationWhat other records share the same CorrelationId or caller?
Business contextWas there an approved reason for the resource to be removed?
What the evidence can and cannot prove
Azure Activity Log evidence can establish that Azure recorded a management operation, when it occurred, the affected scope and caller-related context available in the event.
It does not automatically establish malicious intent, and the caller value should be interpreted with the surrounding identity, automation and business context.
Likewise, the absence of a particular event from a Log Analytics workspace may reflect collection or retention choices rather than proof that an operation never occurred.
Prove the operation first. Attribute intent after correlation.
It does not automatically establish malicious intent, and the caller value should be interpreted with the surrounding identity, automation and business context.
Likewise, the absence of a particular event from a Log Analytics workspace may reflect collection or retention choices rather than proof that an operation never occurred.
Prove the operation first. Attribute intent after correlation.
The lesson
The Azure resource was gone.
That did not make the investigation impossible.
Agent Foskett moved to the control plane, found the delete operation, identified the caller context, followed the correlation ID and reconstructed the surrounding management activity.
Deletion changes the environment. It does not necessarily erase the history of how the environment was changed.
That did not make the investigation impossible.
Agent Foskett moved to the control plane, found the delete operation, identified the caller context, followed the correlation ID and reconstructed the surrounding management activity.
Deletion changes the environment. It does not necessarily erase the history of how the environment was changed.
Investigation principle: When an Azure resource disappears, investigate the management-plane event that made it disappear.
Related investigations
Agent Foskett InvestigationsContinue through the complete collection of real-world Microsoft security investigations.KQL Threat HuntingExplore practical investigation techniques across Microsoft Defender XDR, Microsoft Sentinel and Azure telemetry.SOC Analyst AcademyBuild practical investigation and triage skills across identity, endpoint, email and cloud security.
Final thought
Deleting an Azure resource removes the thing investigators can see in the portal.
It does not automatically remove the record of the management operation that removed it.
Start with the delete event. Preserve the exact operation. Identify the caller. Follow the correlation ID. Then expand outward until the change makes sense.
The resource was gone.
The control-plane trail remained.
The Activity Log knew who did it.
Follow the evidence. Build the timeline.
The Logs Already Knew! 🔎
It does not automatically remove the record of the management operation that removed it.
Start with the delete event. Preserve the exact operation. Identify the caller. Follow the correlation ID. Then expand outward until the change makes sense.
The resource was gone.
The control-plane trail remained.
The Activity Log knew who did it.
Follow the evidence. Build the timeline.
The Logs Already Knew! 🔎
