An Azure backup service that provides built-in management at scale.
Hello PIYUSH SOLANKI,
Welcome to the Microsoft Q&A and thank you for posting your questions here.
I understand that you would like to know more about the older Snapshots and Automating Backup using different ways in Azure.
This is a usage-history question, not just an age/inventory question. You can identify old snapshots and you can identify whether they are currently referenced by disks that were created from them, but you cannot retroactively prove historical “non-use” for deleted derived resources unless you retained the relevant control-plane logs. Azure keeps Activity Log data for 90 days by default, and Microsoft explicitly states that Activity Log records create, update, delete, and action operations, not reads; for longer or centralized retention, you must configure a diagnostic setting. - https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings
However, you can solve your requirement as follows:
- Use Azure Resource Graph to list all
Microsoft.Compute/snapshotsolder than 30 days usingproperties.timeCreated.
https://learn.microsoft.com/en-us/azure/governance/resource-graph/, and https://docs.azure.cn/en-us/governance/resource-graph/first-query-portal shows you how to.Resources | where type =~ 'microsoft.compute/snapshots' | extend snapshotTimeCreated = todatetime(properties.timeCreated) | where snapshotTimeCreated < ago(30d) | project snapshotId = id, snapshotName = name, resourceGroup, subscriptionId, location, snapshotTimeCreated | order by snapshotTimeCreated asc - Use managed disk metadata to determine whether any current managed disk was created from a snapshot, because disks created with Copy expose
properties.creationData.sourceResourceId, which can point to the snapshot ARM ID. Since Azure’s documented restore flow is snapshot → managed disk → VM, this is the correct linkage for “used to create a VM or disk.” https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/disks, https://learn.microsoft.com/en-us/rest/api/compute/disks/create-or-update?view=rest-compute-2025-11-01, https://learn.microsoft.com/en-us/azure/virtual-machines/scripts/create-managed-disk-from-snapshot - If you need to know whether a snapshot was used historically in the last 30 days, including cases where the derived disk/VM was later deleted, you must rely on Azure Monitor Activity Log (90-day default retention) or on diagnostic settings that exported those logs to Log Analytics/Storage/Event Hubs. Without preserved control-plane logs, that historical answer cannot be reconstructed reliably after the fact. https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema, and https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings
- If your real objective is automatic snapshot retention and cleanup, do not treat manual snapshots as your backup platform; use Azure Disk Backup, which Microsoft documents as automating snapshot lifecycle management and retention for managed disks. https://learn.microsoft.com/en-us/azure/backup/disk-backup-overview and https://learn.microsoft.com/en-us/azure/backup/backup-managed-disks gibes more insight on how to.
I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.
Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.