Query Details
Azure Subscription Budget Deletion
Query
AzureActivity | where OperationNameValue == "MICROSOFT.CONSUMPTION/BUDGETS/DELETE" or OperationNameValue == "MICROSOFT.COSTMANAGEMENT/BUDGETS/DELETE"
Explanation
This query is searching through Azure activity logs to find records where a budget deletion operation has occurred. Specifically, it is looking for two types of operations: one related to the deletion of budgets under "MICROSOFT.CONSUMPTION" and the other under "MICROSOFT.COSTMANAGEMENT". Essentially, it filters the logs to show only the activities where budgets were deleted in these two contexts.
Details
Jay Kerai
Released: January 24, 2025
Tables
AzureActivity
Keywords
AzureActivityConsumptionBudgetsCostManagement
Operators
|where==or