Azure Function App Stopped Or Deleted
Query
AzureActivity
| where OperationNameValue == "StopWebSite" or OperationName == "DeleteWebSite" or OperationNameValue == "MICROSOFT.WEB/SITES/DELETE"
| where ActivityStatusValue startswith "Succe" or ActivityStatusValue startswith "accept"
//Azure Activity must be enabled https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=log-analytics?WT.mc_id=MVP_473477Explanation
This query is searching through Azure Activity logs to find records of specific operations related to websites. It looks for activities where a website was stopped or deleted. Additionally, it filters these activities to only include those that were successful or accepted.
Details
Jay Kerai
Released: October 3, 2025
Tables
AzureActivity
Keywords
AzureActivityOperationNameStatus
Operators
AzureActivity|where==orstartswith