Share via

someone deleted my working queue what happended to it, how do see who deleted it and when

Yale Farmer 36 Reputation points
2025-10-01T11:42:52.9233333+00:00

my azure service bus queue is deleted, it was active on 29-Sept after that it just gone. its not a manual mistake i checked with my team. how to see it on azure portal who deleted it?

Azure Service Bus
Azure Service Bus
An Azure service that provides cloud messaging as a service and hybrid integration.
Answer accepted by question author
  1. Sean Devore 80 Reputation points
    2025-10-01T13:06:36.0066667+00:00

    Step 1: Check the audit log immediately

    • Go to Azure Portal → Your Work Queue Service → Activity Log

    Set time range to "Custom", covering when you last saw the queue

    Filter event type by "Delete"

    Step 2: Identify key details The log will show:

    Executor (Object ID / UPN)

    Precise timestamp (down to the second)

    Source terminal IP address

    Real case: Last week, a teammate accidentally deleted a service bus queue. We found the delete log in 2 minutes and used New-AzServiceBusQueue to restore it. If the queue was recently deleted, also check "Recover deleted resources" – you might get it back instantly!Step 1: Check the audit log immediately

    Go to Azure Portal → Your Work Queue Service → Activity Log

    Set time range to "Custom", covering when you last saw the queue

    Filter event type by "Delete"

    Step 2: Identify key details
    The log will show:

    Executor (Object ID / UPN)

    Precise timestamp (down to the second)

    Source terminal IP address

    Real case:
    Last week, a teammate accidentally deleted a service bus queue. We found the delete log in 2 minutes and used New-AzServiceBusQueue to restore it. If the queue was recently deleted, also check "Recover deleted resources" – you might get it back instantly!

    1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rupesh Asati 865 Reputation points Microsoft External Staff Moderator
    2025-10-01T12:07:32.39+00:00

    Hello Yale Farmer,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    I understand that you are dealing with a deleted Azure Service Bus queue that was active until September 29th.

    Please check the below steps:

    1. Check Activity Logs Use Azure Activity Logs to determine who deleted the queue and when. Navigate to the Azure Portal, go to Monitor > Activity Log, and filter by the Service Bus namespace and the time frame when the queue was deleted.
    2. Review Auto-Delete Settings Verify if the AutoDeleteOnIdle property was set on the queue. If it was, consider adjusting the duration or disabling it to prevent unintended deletions. Microsoft Learn
    3. Audit Permissions Review the access control settings (IAM) for the Service Bus namespace to ensure that only authorized users have permissions to delete queues.
    4. Can you confirm if you have checked the Azure Activity Log and what the results were?

    AutoDeleteOnIdle triggered deletions do not generate an explicit Azure Activity Log event

    I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

    Thanks

    0 comments
  2. Jose Benjamin Solis Nolasco 6,051 Reputation points
    2025-10-01T12:30:56.2+00:00

    @Yale Farmer I hope you are doing well,

    Welcome to Microsoft Q&A

    You can go to the Azure portal, navigate to Monitor > Activity Log, and filter logs for the specific Service Bus namespace or queue. Look for "Delete" operations targeting the queue resource during the relevant time window. The logs will show the timestamp of the delete operation and the identity (user or service principal) who performed it.

    Check the Activity Log for delete operations on the queue resource for the date after September 29th. If you have Azure Policy or Role-Based Access Control (RBAC) configured, review who has delete permissions on the Service Bus namespace or queues. If you suspect an unauthorized or mistaken deletion, you can use Azure's Role and Audit features to tighten permissions and enable alerts on such operations in the future.

    😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.