The Azure troubleshooting workflow

1A small web VM to break

Create a VM with nginx and an NSG rule for HTTP (about 4 minutes):

az group create --name rg-saat-l59 --location centralindia --tags course=saatvedha-azure lesson=59 -o none
az vm create --resource-group rg-saat-l59 --name vm-web --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --public-ip-sku Standard --nsg-rule NONE --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=59 -o none
az network nsg rule create --resource-group rg-saat-l59 --nsg-name vm-webNSG --name allow-http --priority 100 --direction Inbound --access Allow --protocol Tcp --destination-port-ranges 80 -o none
az vm run-command invoke --resource-group rg-saat-l59 --name vm-web --command-id RunShellScript --scripts 'apt-get update -qq > /dev/null; DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nginx > /dev/null; systemctl is-active nginx' --query "value[0].message" -o tsv
$ip = az vm show --resource-group rg-saat-l59 --name vm-web --show-details --query publicIps -o tsv
$vmId = az vm show --resource-group rg-saat-l59 --name vm-web --query id -o tsv
curl.exe -sI --max-time 5 http://$ip/ | Select-Object -First 1

You should see:

HTTP/1.1 200 OK

2Stage the incident

Make two changes, then wait 5 minutes and pretend you’ve just been paged with “the website is down”:

az network nsg rule delete --resource-group rg-saat-l59 --nsg-name vm-webNSG --name allow-http
az vm deallocate --resource-group rg-saat-l59 --name vm-web

3Is it Azure? Service Health and Resource Health

Check for active Azure incidents, then the VM’s own health:

az graph query -q "servicehealthresources | where type =~ 'Microsoft.ResourceHealth/events' | extend kind = tostring(properties.EventType), status = tostring(properties.Status), title = tostring(properties.Title) | where kind == 'ServiceIssue' and status == 'Active' | project title" --query "data[].title" -o tsv
az rest --method get --url "https://management.azure.com${vmId}/providers/Microsoft.ResourceHealth/availabilityStatuses/current?api-version=2020-05-01" --query "properties.{state:availabilityState, summary:summary, reason:reasonType}"

You should see something like this (the first command prints nothing when Azure has no active incident):

{
  "reason": "Customer Initiated",
  "state": "Unavailable",
  "summary": "This virtual machine is stopping and deallocating as requested by an authorized user or process."
}

Azure isn’t having an incident, and the VM was stopped on purpose by someone with access. That’s already most of the answer, in two commands.

4Who did what: the Activity log

Save this as C:\azure-lab\Get-RecentChanges.ps1. You’ll use it in every Phase 4 lesson:

param(
    [Parameter(Mandatory)][string]$ResourceGroup,
    [int]$Hours = 2
)
# SaatVedha Azure Lesson 59: who changed what in a resource group, newest first
$start = (Get-Date).AddHours(-$Hours).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
$events = az monitor activity-log list --resource-group $ResourceGroup --start-time $start --query "[?status.value=='Succeeded' && !contains(operationName.value, '/read')]" -o json | ConvertFrom-Json
if (-not $events) { "No changes in $ResourceGroup in the last $Hours hour(s)."; return }
$events |
    Sort-Object { [datetime]$_.eventTimestamp } -Descending |
    Select-Object @{ n = 'Time'; e = { ([datetime]$_.eventTimestamp).ToLocalTime().ToString('HH:mm:ss') } },
                  @{ n = 'Operation'; e = { $_.operationName.localizedValue } },
                  @{ n = 'Resource'; e = { ($_.resourceId -split '/')[-1] } },
                  @{ n = 'Who'; e = { $_.caller } } |
    Format-Table -AutoSize

Run it:

C:\azure-lab\Get-RecentChanges.ps1 -ResourceGroup rg-saat-l59 -Hours 1

You should see something like this (your times are local, your account is the caller):

Time     Operation                  Resource   Who
----     ---------                  --------   ---
10:42:40 Deallocate Virtual Machine vm-web     priya@contoso.com
10:41:02 Delete Security Rule       allow-http priya@contoso.com
10:36:15 Run Command on Virtual Machine vm-web priya@contoso.com
10:35:51 Create or Update Security Rule allow-http priya@contoso.com

5Exactly what changed: Change Analysis

Query Resource Graph for property-level changes in the group:

az graph query -q "resourcechanges | extend ts = todatetime(properties.changeAttributes.timestamp), target = tostring(properties.targetResourceId), kind = tostring(properties.changeType), who = tostring(properties.changeAttributes.changedBy) | where target contains 'rg-saat-l59' | project ts, kind, who, target, changes = properties.changes | order by ts desc | take 5" --query "data[].{time:ts, kind:kind, who:who, resource:target}" -o table

You should see something like this:

Time                          Kind    Who                Resource
----------------------------  ------  -----------------  -------------------------------------------------------------
2026-10-21T05:12:40.0000000Z  Update  priya@contoso.com  /subscriptions/.../virtualMachines/vm-web
2026-10-21T05:11:02.0000000Z  Delete  priya@contoso.com  /subscriptions/.../securityRules/allow-http

Add changes to the --query to see the before and after values of each property, such as the VM’s power state. Then fix it:

az vm start --resource-group rg-saat-l59 --name vm-web
az network nsg rule create --resource-group rg-saat-l59 --nsg-name vm-webNSG --name allow-http --priority 100 --direction Inbound --access Allow --protocol Tcp --destination-port-ranges 80 -o none
$ip = az vm show --resource-group rg-saat-l59 --name vm-web --show-details --query publicIps -o tsv
curl.exe -sI --max-time 5 http://$ip/ | Select-Object -First 1

The site answers HTTP/1.1 200 OK again.

✅ Checkpoint: You found both changes, who made them and when, ruled out Azure, and restored the site.