Query Details
Azure Communication Services Deleted
Query
AzureActivity | where OperationNameValue == "MICROSOFT.COMMUNICATION/COMMUNICATIONSERVICES/DELETE" | where ActivityStatusValue startswith "Succe" or ActivityStatusValue startswith "accept" // Comment out if you want to look for attempts //Azure Activity must be enabled https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=log-analytics
Explanation
This query is searching through Azure Activity logs to find records where a specific operation, "MICROSOFT.COMMUNICATION/COMMUNICATIONSERVICES/DELETE," was performed. It filters these records to only include those where the activity status starts with "Succe" (likely indicating "Success") or "accept" (possibly indicating "accepted"). The comment suggests that if you want to include attempts that were not successful, you can modify the query by removing the status filter. Additionally, there's a note that Azure Activity logging must be enabled for this query to work, with a link provided for more information on setting that up.
Details
Jay Kerai
Released: September 5, 2025
Tables
AzureActivity
Keywords
AzureActivityCommunicationServices
Operators
AzureActivity|where==startswithor//