Thanks for posting your question in the Microsoft Q&A forum.
Azure may automatically start a stopped VM when extensions (like the SQL IaaS Agent) need to be created, updated, or deleted. These operations require the VM to be running so scripts/agents inside the OS can execute. The actions show up under SQLVMResourceProviderAuth because they’re triggered by the SQL VM Resource Provider, not by a user.
Afterward, Azure does not stop the VM again, you need to shut it down manually if you don’t want it left running. This is expected behavior.
Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful