I've been working on personal projects and had accumulated several Azure resource groups, most of which were no longer in use. I assumed the portal was only showing resources I owned and that I could delete only my own groups, so I started cleaning them up.
Before deleting another group, I noticed that some of its resources clearly didn't belong to me. That's when I realized I had access to other people's resource groups—and I had already deleted one belonging to the company.
I don't know whether it contained anything important or whether the company has backups. I tried to submit a high-severity support ticket, but I apparently don't have permission to do that. I also exported the past three months of activity logs, but aside from my own actions, I only saw unrelated one-off activity involving a private resource group I couldn't access or identify.
Is there a way to determine exactly what was deleted from the resource group? The information in the portal and the available JSON didn't seem useful. In a company with roughly 10,000 employees, would important production resources normally be protected from this kind of deletion? I'm in a completely nontechnical role and don't know who I'm supposed to contact. What should I do immediately?
3 Answers
Having permission to delete an entire resource group while being unable to open a support ticket is a serious access-control problem, but that is something the company can investigate afterward. For now, stop making changes, preserve the relevant timestamps and screenshots or log exports, and escalate through every normal workplace channel available—your manager, supervisor, HR, security team, or IT help desk.
Tell your supervisor, internship coordinator, department lead, or whoever manages your work immediately. Don’t spend more time trying to determine whether the resource group was important or whether backups exist. Azure recovery options and retention periods can be time-sensitive, so the technical team needs to know as soon as possible what was deleted and when.
Resource-group deletion can remove all of the resources inside it, and the activity log may not provide a complete inventory of everything that was there. Administrators may be able to use Azure recovery features, resource locks, backups, deployment records, or other monitoring systems, but those options depend on the individual services and how the environment was configured.
The sooner the incident is reported, the better. Some recovery data and backups are retained only for limited periods, and the cloud administrators are the only people who can properly assess that.
Even if the company made a permissions mistake by giving you delete access, waiting or trying to investigate quietly can make recovery harder. Report the exact resource group, approximate deletion time, and the actions you took.