How to retrieve vmid of a deleted azure VM

Question

Is there an api or powershell command available to retrieve vmid of a deleted vm in azure. I have a requirement to retrieve this value to update our internal cmdb system. So far tried with change analysis rest apis with no luck, since the ARM template is also removed with VM deletion API calls are returning no value. I can see the vmid in the changed properties of the resource group activity log , just wondering if there a way retrieve this value programmatically. Please let know of anyone has tried this before, any help will be appreciated.

Thanks,

Best to post on [sf] - it's off-topic here, as it's not a programming question — David Makogon, Jun 24 '23 at 22:46

score 0 · Answer 1 · answered Jun 19 '23 at 12:41

To retrieve vmid of a deleted azure VM make use of below PowerShell Commands:

Get-AzActivityLog -ResourceId "/subscriptions/209654eb-1867-49df-9395XXXXX/resourcegroups/RgName/providers/microsoft.compute/virtualmachines/Vmname"

Output:

HttpRequest          : 
                       ClientId        : 5c4691fc-a586-466a-80d7-XXXXX
                       Method          : PUT
                       Url             : https://management.azure.com/subscriptions/209654eb-1867-49df-9395-7fXXXXX/resourcegroups/imran/providers/Micros
                       oft.Compute/virtualMachines/vm333?api-version=2022-03-01
                       ClientIpAddress : 49.207.231.16
Properties           : 
                       statusCode     : Created
                       serviceRequestId: 
                       responseBody   : {"name":"vm333","id":"/subscriptions/209654eb-1867-49df-9395-7fXXXXX/resourceGroups/imran/providers/Microsoft.Com
                       pute/virtualMachines/vm333","type":"Microsoft.Compute/virtualMachines","location":"eastus","properties":{"vmId":"109bfd81-569c-425f-bc7
                       7-83de341fddae","hardwareProfile":{"vmSize":"Standard_B1s"},"storageProfile":{"imageReference":{"publisher":"MicrosoftWindowsServer","o
                       ffer":"WindowsServer","sku":"2022-datacenter-azure-edition","version":"latest","exactVersion":"20348.1787.230607"},"osDisk":{"osType":"
                       Windows","createOption":"FromImage","caching":"ReadWrite","managedDisk":{"storageAccountType":"StandardSSD_LRS"},"deleteOption":"Delete
                       ","diskSizeGB":127},"dataDisks":[],"diskControllerType":"SCSI"},"osProfile":{"computerName":"vm333","adminUsername":"imran123","windows
                       Configuration":{"provisionVMAgent":true,"enableAutomaticUpdates":true,"patchSettings":{"patchMode":"AutomaticByOS","assessmentMode":"Im
                       ageDefault","enableHotpatching":false},"enableVMAgentPlatformUpdates":false},"secrets":[],"allowExtensionOperations":true,"requireGuest
                       ProvisionSignal":true},"securityProfile":{"uefiSettings":{"secureBootEnabled":true,"vTpmEnabled":true},"securityType":"TrustedLaunch"},
                       "networkProfile":{"networkInterfaces":[{"id":"/subscriptions/209654eb-1867-49df-9395-7f0905ec6833/resourceGroups/imran/providers/Micros
                       oft.Network/networkInterfaces/vm333470","properties":{"deleteOption":"Detach"}}]},"diagnosticsProfile":{"bootDiagnostics":{"enabled":tr
                       ue}},"licenseType":"Windows_Server","provisioningState":"Creating","timeCreated":"2023-06-19T06:57:40.4398142+00:00"}}
                       eventCategory  : Administrative
                       entity         : 
                       /subscriptions/209654eb-1867-49df-9395-7f0905ec6833/resourcegroups/imran/providers/Microsoft.Compute/virtualMachines/vm333
                       message        : Microsoft.Compute/virtualMachines/write
                       hierarchy      : 2773f7fd-d343-4afXXXXXX/VenkatGroup/209654eb-1867-49df-93XXXXX
Level                : Informational
SubmissionTimestamp  : 19-06-2023 06:58:46
EventTimestamp       : 19-06-2023 06:57:42
EventName            : End request
Category             : Administrative
ResourceProviderName : Microsoft.Compute
OperationName        : Create or Update Virtual Machine
Status               : Accepted
SubStatus            : Created (HTTP Status Code: 201)
Caller               : mtuser1@m365x56209219.onmicrosoft.com
Description          : 
Id                   : /subscriptions/209654eb-1867-49df-9395-7f0905ec6833/resourcegroups/imran/providers/Microsoft.Compute/virtualMachines/vm333/events/2a108
                       5f1-c590-4479-a547-e6c53d0acf64/ticks/638227546629109956
EventDataId          : 2a1085f1-c590-4479-a547-e6c53d0acf64
CorrelationId        : 9021d8d7-4ad1-4ca6-893d-1XXXXX
ResourceGroupName    : imran
ResourceId           : /subscriptions/209654eb-1867-49XXXXX7f0905ec6833/resourcegroups/imran/providers/Microsoft.Compute/virtualMachines/vm333
ResourceType         : 
OperationId          : 4ff37a22-dc55-4016-be4a-8XXXXX
SubscriptionId       : 209654eb-186XXXX7f0905ec6833
TenantId             :

You can find vmid of deleted vm in below HTTP request properties like below:

Hello Imran, in my case i am not able to find vmid value in the case of a deleted vm, For existing machines i can see the vmid using the provided command. — Ajith, Jun 19 '23 at 20:46
I have tried in deleted vm only, using the above script u can find vmid in bottom of output HTTP request properties as shown in above screenshot — Imran, Jun 20 '23 at 06:11
okay, in my case most of the vms were more than 90 days old, so i think the events during the creation of vm that has the vmid in it cannot be queried. — Ajith, Jun 20 '23 at 20:09
The VM ID is available in the activity log of the resource group, but it is only available for a limited time and cannot be retrieved programmatically after the VM has been deleted. — Imran, Jun 23 '23 at 12:15
[Please do not upload images of code/data/errors.](//meta.stackoverflow.com/q/285551) — David Makogon, Jun 24 '23 at 22:46

How to retrieve vmid of a deleted azure VM

1 Answers1