Hello, We have got the list of unattached disks (200+) but there is no information when were those disk detached. Any Idea how we could get disk detach date time. Thank you!

Hi @Anil Kumar Azure does not natively store or display the exact timestamp for when a disk was detached. However, you can use Azure Activity Logs to trace back to when a disk was detached. The Activity Log contains events related to all the operations on your resources, including when disks are detached from virtual machines. On Azure Portal Navigate to the subscription: In the Activity Log, set the Scope to the specific resource group or subscription that contains the disk. You also can try Azure Orphan Resource https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-orphan-resources/ba-p/3492198 Get in touch if you need more help with this issue. --please don't forget to "[ Accept the answer ]" if the reply is helpful--

How to find detach date time for disks in Azure

Accepted answer

Jackson Martins 10,556 Reputation points MVP

2024-06-13T12:01:10.5433333+00:00

Hi @Anil Kumar

Azure does not natively store or display the exact timestamp for when a disk was detached. However, you can use Azure Activity Logs to trace back to when a disk was detached. The Activity Log contains events related to all the operations on your resources, including when disks are detached from virtual machines.

On Azure Portal Navigate to the subscription:

In the Activity Log, set the Scope to the specific resource group or subscription that contains the disk.

You also can try Azure Orphan Resource

https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-orphan-resources/ba-p/3492198

Get in touch if you need more help with this issue.

--please don't forget to "[Accept the answer]" if the reply is helpful--
Please sign in to rate this answer.
Anil Kumar 520 Reputation points

2024-06-14T11:49:24.3566667+00:00

Thank you @Jackson Martins for your response.

Checking via activity log would take too long, we were trying to get this info by KQL but not getting expected result.

Are disks with NULL in lastownershipupdatetime column have been detached ?

Appreciate your response.

Thank you!

Mahesh Goud Juvvadi 1,550 Reputation points Microsoft Vendor

2024-06-19T09:46:48.1333333+00:00

Hi Anil Kumar,

The lastownershipupdatetime column in Azure does not directly indicate whether a disk has been detached.

It represents the last time the ownership of the disk was changed, which could occur during various operations.

NULL value in this column does not necessarily mean the disk has been detached. To specifically identify detached disks, consider using the Azure Activity Logs as mentioned in earlier Answer.

Thank you.

Anil Kumar 520 Reputation points

2024-06-21T09:21:51.7+00:00

Thank you @Mahesh Goud Juvvadi for your helpful response.

#StayBlessednHappy

Anil Kumar 520 Reputation points

2024-06-21T09:23:04.81+00:00

Thank you @Jackson Martins for your response.

Glad to mark your response as an answer!

#StayBlessednHappy

Mahesh Goud Juvvadi 1,550 Reputation points Microsoft Vendor

2024-06-21T11:18:33.1066667+00:00

Hi Anil Kumar,

We're delighted to hear that your issue has been resolved provided by @Jackson Martins. If you encounter any further challenges, please don't hesitate to get in touch with us, and we'll be more than happy to provide additional assistance.

Thank you

Anil Kumar 520 Reputation points

2024-06-21T12:03:44.4433333+00:00

Thank you @Mahesh Goud Juvvadi !

KQL query to identify detached disks beyond certain days would be very much appreciated as Activity log way is not feasible at large scale.

Have a great weekend ahead!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to find detach date time for disks in Azure

1 additional answer

Your answer