VMs Deletion

[Yashrajsp10]

Hi Techies,

Our SOC team got an alert where 25 VMs were deleted in a single session. The investigation logs in 365 Defender show that the VMs were successfully deleted the same was confirmed with the user who deleted those VMs.

But I still see those VMs as resources in the subscription. They are still there.

What could be the reason? Probably that it was not deleted properly. Please help. 

Thanks :)

[#2 · Accepted solution]

There could be a delay in the updates being reflected in the subscription view, due to caching or synchronization issues.You should check the status of the deletion process, validate if the VMs are still attached to a resource group, and force a synchronization or clear cache if necessary. It is also advisable to run a script to check the consistency of resources in the subscription.