How to retrieve vmid of a deleted azure VM

Question

Is there an api or powershell command available to retrieve vmid of a deleted vm in azure. I have a requirement to retrieve this value to update our internal cmdb system. So far tried with change analysis rest apis with no luck, since the ARM template is also removed with VM deletion API calls are returning no value. I can see the vmid in the changed properties of the resource group activity log , just wondering if there a way retrieve this value programmatically. Please let know of anyone has tried this before, any help will be appreciated.

Thanks,

Answer 1

To retrieve vmid of a deleted azure VM make use of below PowerShell Commands:

Get-AzActivityLog -ResourceId "/subscriptions/209654eb-1867-49df-9395XXXXX/resourcegroups/RgName/providers/microsoft.compute/virtualmachines/Vmname" 

Output:

HttpRequest          : 
                       ClientId        : 5c4691fc-a586-466a-80d7-XXXXX
                       Method          : PUT
                       Url             : https://management.azure.com/subscriptions/209654eb-1867-49df-9395-7fXXXXX/resourcegroups/imran/providers/Micros
                       oft.Compute/virtualMachines/vm333?api-version=2022-03-01
                       ClientIpAddress : 49.207.231.16
Properties           : 
                       statusCode     : Created
                       serviceRequestId: 
                       responseBody   : {"name":"vm333","id":"/subscriptions/209654eb-1867-49df-9395-7fXXXXX/resourceGroups/imran/providers/Microsoft.Com
                       pute/virtualMachines/vm333","type":"Microsoft.Compute/virtualMachines","location":"eastus","properties":{"vmId":"109bfd81-569c-425f-bc7
                       7-83de341fddae","hardwareProfile":{"vmSize":"Standard_B1s"},"storageProfile":{"imageReference":{"publisher":"MicrosoftWindowsServer","o
                       ffer":"WindowsServer","sku":"2022-datacenter-azure-edition","version":"latest","exactVersion":"20348.1787.230607"},"osDisk":{"osType":"
                       Windows","createOption":"FromImage","caching":"ReadWrite","managedDisk":{"storageAccountType":"StandardSSD_LRS"},"deleteOption":"Delete
                       ","diskSizeGB":127},"dataDisks":[],"diskControllerType":"SCSI"},"osProfile":{"computerName":"vm333","adminUsername":"imran123","windows
                       Configuration":{"provisionVMAgent":true,"enableAutomaticUpdates":true,"patchSettings":{"patchMode":"AutomaticByOS","assessmentMode":"Im
                       ageDefault","enableHotpatching":false},"enableVMAgentPlatformUpdates":false},"secrets":[],"allowExtensionOperations":true,"requireGuest
                       ProvisionSignal":true},"securityProfile":{"uefiSettings":{"secureBootEnabled":true,"vTpmEnabled":true},"securityType":"TrustedLaunch"},
                       "networkProfile":{"networkInterfaces":[{"id":"/subscriptions/209654eb-1867-49df-9395-7f0905ec6833/resourceGroups/imran/providers/Micros
                       oft.Network/networkInterfaces/vm333470","properties":{"deleteOption":"Detach"}}]},"diagnosticsProfile":{"bootDiagnostics":{"enabled":tr
                       ue}},"licenseType":"Windows_Server","provisioningState":"Creating","timeCreated":"2023-06-19T06:57:40.4398142+00:00"}}
                       eventCategory  : Administrative
                       entity         : 
                       /subscriptions/209654eb-1867-49df-9395-7f0905ec6833/resourcegroups/imran/providers/Microsoft.Compute/virtualMachines/vm333
                       message        : Microsoft.Compute/virtualMachines/write
                       hierarchy      : 2773f7fd-d343-4afXXXXXX/VenkatGroup/209654eb-1867-49df-93XXXXX
Level                : Informational
SubmissionTimestamp  : 19-06-2023 06:58:46
EventTimestamp       : 19-06-2023 06:57:42
EventName            : End request
Category             : Administrative
ResourceProviderName : Microsoft.Compute
OperationName        : Create or Update Virtual Machine
Status               : Accepted
SubStatus            : Created (HTTP Status Code: 201)
Caller               : [email protected]
Description          : 
Id                   : /subscriptions/209654eb-1867-49df-9395-7f0905ec6833/resourcegroups/imran/providers/Microsoft.Compute/virtualMachines/vm333/events/2a108
                       5f1-c590-4479-a547-e6c53d0acf64/ticks/638227546629109956
EventDataId          : 2a1085f1-c590-4479-a547-e6c53d0acf64
CorrelationId        : 9021d8d7-4ad1-4ca6-893d-1XXXXX
ResourceGroupName    : imran
ResourceId           : /subscriptions/209654eb-1867-49XXXXX7f0905ec6833/resourcegroups/imran/providers/Microsoft.Compute/virtualMachines/vm333
ResourceType         : 
OperationId          : 4ff37a22-dc55-4016-be4a-8XXXXX
SubscriptionId       : 209654eb-186XXXX7f0905ec6833
TenantId             : 

You can find vmid of deleted vm in below HTTP request properties like below: