URGENT: My Azure VM was deleted 9 hours ago by a complete stranger. Apparent security breach. My site is down. Logs remain. PLEASE HELP.

Hello @Robert Heckes

Step 1: Secure Your Environment Right Now

Revoke the unauthorized account immediately

Go to portal.azure.com → Microsoft Entra ID (formerly Azure AD)

Users → find the Outlook.com account → Delete or Block sign-in

Subscriptions → your subscription → Access control (IAM)

Find that account in role assignments → Remove

Rotate everything that account could have touched

All service principal secrets and certificates

Any storage account keys

Database connection strings

App Service publish profiles

Any secrets in Key Vault (check access policies for that account)

Enable MFA on your account if not already on

Entra ID → Users → your account → Authentication methods

Review all other accounts with subscription access

Subscription → IAM → Role assignments — audit every entry, remove anything unfamiliar

Step 2: Preserve Evidence Before It Ages Out

Activity logs are retained for only 90 days. Export everything now.

Azure Portal → Monitor → Activity Log

→ Filter: last 30 days, your subscription

→ Export → Download as JSON or CSV

Also capture:

The specific Deallocate and Delete log entries as screenshots with full event detail expanded

The "Event initiated by" field clearly visible

Entra ID sign-in logs for that account: Entra ID → Sign-in logs → filter by that username

Step 3: Contact Microsoft Support — Do This Now

portal.azure.com → Help + Support → New support request

Issue type: Security

Problem type: Unauthorized access / Security incident

Mark severity as Critical / A

Tell them:

Your subscription ID

The VM name and resource group

Exact timestamps of the Deallocate and Delete events

The Outlook.com account shown in the activity log

That you are requesting VM restoration from platform-side backup if possible

That you need a full investigation of how this account gained access

Microsoft has an internal security response team (MSRC) for exactly this scenario. A security-classified ticket gets escalated differently than a standard support request.

Step 4: VM Recovery Options

Check for managed disk snapshots first

Portal → Disks → look for orphaned disks or snapshots

Portal → Snapshots → filter by your resource group

If the OS disk snapshot exists, you can rebuild the VM from it immediately.

Check Azure Backup

Portal → Backup center → Backup instances

If backup was configured, you can restore from there directly.

If no snapshots or backups exist

Microsoft support may be able to restore from platform-side retention in some cases, but this is not guaranteed and depends on your subscription tier and how long ago deletion occurred. 9 hours is still within the window where this is worth asking about explicitly in your support ticket.

Rebuild from scratch if needed

If recovery fails, you'll need to redeploy the VM. Your logs and data disks may still exist as orphaned resources — check Disks in the portal before concluding data is lost.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

This is unauthorized access. Someone with that Outlook.com account had permission in your Azure subscription and deleted the VM. Please do this now:

-Change your Microsoft account password and turn on MFA: https://account.microsoft.com/security

-In Azure: Subscriptions → your subscription → Access control (IAM) → Role assignments. Remove that Outlook.com account.

-Also check Microsoft Entra ID → Users and remove it if it is listed there.

-Search Disks in Azure. If you see an unattached disk with the old VM name, create a new VM from it.

-Check Backup / Recovery Services vaults. If backup was on, restore the VM. If the backup was deleted, it may still be recoverable for about 14 days (look for a red soft-delete icon → Undelete → Restore).

-Open a Microsoft support case Billing security help is free: https://azure.microsoft.com/support/create-ticket

Tell them- an unknown Outlook.com account deallocated and deleted your Windows VM about 9 hours ago without your permission. Ask them to treat it as a security incident and help recover the VM/disk if possible. Include your subscription ID, VM name, resource group, time, and that Outlook.com address from the Activity Log.

If you cannot open the portal, call Microsoft using only official numbers: https://support.microsoft.com/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

Azure cannot always undelete a VM if the disk and backups are gone, so check Disks and Backup first, then contact Support.This is unauthorized access. Someone with that Outlook.com account had permission in your Azure subscription and deleted the VM. Please do this now:

-Change your Microsoft account password and turn on MFA: https://account.microsoft.com/security

-In Azure: Subscriptions → your subscription → Access control (IAM) → Role assignments. Remove that Outlook.com account.

-Also check Microsoft Entra ID → Users and remove it if it is listed there.

• Try to get the website back ,deleting the VM does not always delete the disk. -Search Disks in Azure. If you see an unattached disk with the old VM name, create a new VM from it. Check Backup / Recovery Services vaults. If backup was on, restore the VM. If the backup was deleted, it may still be recoverable for about 14 days (look for a red soft-delete icon → Undelete → Restore).