While cleaning up several Azure resource groups I had created for personal projects, I assumed the portal was only showing resources associated with me. I deleted one group before noticing that some of its contents clearly belonged to the company. I now realize I had permission to delete resources belonging to other people.
I do not know how important the resource group was or whether the company has backups. I tried to raise a high-severity support ticket, but I apparently lack permission to do so. I also exported roughly three months of activity-log data, but it mostly shows my own actions and a few unrelated events involving a private resource group that I cannot access.
Is there a way to determine what was deleted from the resource group? Would a large company typically have protections or backups preventing serious damage? I work in a nontechnical role and am unsure who to contact. What should I do immediately?
4 Answers
Tell your supervisor, internship coordinator, department lead, or whoever manages your work immediately. Do not wait while trying to determine whether the resource group was important. Azure recovery options and logs may be time-sensitive, and the people responsible for the environment need to start the recovery process as soon as possible.
You absolutely do have someone to escalate this to, even if you are not technical. Contact your direct manager or the person responsible for your internship and clearly state that you accidentally deleted a company resource group. Be factual, take responsibility, and emphasize that you are reporting it immediately so they have the best chance of restoring anything affected.
A large organization may have backups, soft-delete settings, deployment records, or other recovery mechanisms, but none of that is guaranteed. The activity log may show the deletion operation and metadata, though it usually will not reconstruct every resource or its data by itself. The company’s Azure administrators or incident-response team will need to check those records and begin recovery.
The fact that you could delete the group but could not open a recovery ticket suggests the permissions were poorly configured, but that does not change the next step: report it right away and give them the exact resource-group name, approximate deletion time, subscription or tenant details, and anything you exported from the activity log. Avoid making further changes or attempting recovery yourself unless the responsible administrators direct you.
Understood. I will stop investigating on my own and report the deletion with the exact time and resource-group details immediately.