Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
user deleted abruptly- need root cause support
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 20%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVR%3C/text%3E%3C/svg%3E)
Venkat Rao
0
Reputation points
Dear support team,
I have a weird scenario. one of my devops guy have alleged that his user id was deleted/removed.
not sure who deleted/removed his access, and i strongly think that he may have messed around and his id may have been deleted or removed. he was initially set as contributor, but today i.e., on date : 12/09/2025, morning around 10AM CST, he showed his screen where he was not able to access the app that we have uploaded via the azure app service module. his earlier id that was mapped to contributor role was "PII.com". i want to understand what could have gone wrong, and if he deleted his own id by any chance, or something that could have deleted , and i want to know the root cause. i would highly appreciate if you can get me an engineer who can help me in this regard. as we are a startup company, we need some guidance from microsoft azure support team, so as to figure out and get some recommendation on the future usage of the platform.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 6%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJH%3C/text%3E%3C/svg%3E)
Jilakara Hemalatha 6,130 Reputation points Microsoft External Staff Moderator2025-12-10T05:34:22.8033333+00:00 Hi Venkat Rao
Thank you for reporting the access issue to better understand your scenario, could you please clarify the following:
- Which specific Azure resource or service was the user trying to access when the issue occurred?
2.Was the access issue related to the Azure Portal (resource management) or the actual application running in App Service?
3.Apart from this resource, is the user able to access other Azure services without any problems?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 10,085 Reputation points Microsoft External Staff Moderator2025-12-10T18:34:25.7466667+00:00 Hello Venkat Rao,
Can you please check Audit Logs:
- Sign in to the Azure portal → Microsoft Entra ID → Audit Logs.
- Filter by Date: 12/09/2025, Activity: User deleted or role changes or user sign-in failures.
- Please check for any entries related to
******@xx.com. This will help identify whether the deletion/removal was done by another admin, automatically, or by the user themselves.
Let me know if any further queries - feel free to reach out!
-
Rukmini 10,085 Reputation points Microsoft External Staff Moderator
2025-12-11T17:04:35.9266667+00:00 Hello Venkat Rao, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Sign in to comment
Sign in to answer