Azure Subscription Budget Deletion
Query
AzureActivity
| where OperationNameValue == "MICROSOFT.CONSUMPTION/BUDGETS/DELETE" or OperationNameValue == "MICROSOFT.COSTMANAGEMENT/BUDGETS/DELETE"Explanation
This query is searching through the AzureActivity logs to find records where a budget deletion operation has occurred. Specifically, it looks for activities where the operation name indicates that a budget was deleted, either through the "MICROSOFT.CONSUMPTION/BUDGETS/DELETE" operation or the "MICROSOFT.COSTMANAGEMENT/BUDGETS/DELETE" operation. Essentially, it's filtering the logs to show only the events related to the deletion of budgets in Azure.