Azure Communication Services Deleted
Query
AzureActivity
| where OperationNameValue == "MICROSOFT.COMMUNICATION/COMMUNICATIONSERVICES/DELETE"
| where ActivityStatusValue startswith "Succe" or ActivityStatusValue startswith "accept" // Comment out if you want to look for attempts
//Azure Activity must be enabled https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=log-analytics?WT.mc_id=MVP_473477Explanation
This query is designed to search through Azure Activity logs to find specific events related to the deletion of communication services. Here's a simple breakdown:
-
Data Source: The query is looking at the
AzureActivitytable, which contains logs of various activities within Azure. -
Filter by Operation: It filters the logs to find only those entries where the operation performed is the deletion of communication services. This is specified by the operation name:
"MICROSOFT.COMMUNICATION/COMMUNICATIONSERVICES/DELETE". -
Filter by Status: The query further narrows down the results to include only those activities where the status of the operation starts with "Succe" (likely indicating "Success") or "accept" (possibly indicating "Accepted"). This means it is looking for successful or accepted deletion operations.
-
Comment: There is a comment suggesting that if you want to look for deletion attempts (not necessarily successful ones), you can remove or comment out the status filter.
-
Note: There's a reminder that Azure Activity logging must be enabled to capture these events, with a link provided for more information on how to enable it.
In summary, this query is used to identify successful or accepted deletion operations of communication services in Azure, assuming that activity logging is enabled.
Details
Jay Kerai
Released: October 3, 2025
Tables
Keywords
Operators