Share via

Snapshots and Automating Backup using different ways in Azure.

PIYUSH SOLANKI 60 Reputation points
2026-04-27T04:53:49.1566667+00:00

I have been working on azure few days , I wanted to find out the older snapshots say more than 30 days which have not been used to create VM or any new managed disks. The snapshots have not been used to create any resources from the last 30 days .

Azure Backup
Azure Backup

An Azure backup service that provides built-in management at scale.


Answer accepted by question author

  1. Sina Salam 28,606 Reputation points Volunteer Moderator
    2026-04-27T17:31:54.8433333+00:00

    Hello PIYUSH SOLANKI,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    I understand that you would like to know more about the older Snapshots and Automating Backup using different ways in Azure.

    This is a usage-history question, not just an age/inventory question. You can identify old snapshots and you can identify whether they are currently referenced by disks that were created from them, but you cannot retroactively prove historical “non-use” for deleted derived resources unless you retained the relevant control-plane logs. Azure keeps Activity Log data for 90 days by default, and Microsoft explicitly states that Activity Log records create, update, delete, and action operations, not reads; for longer or centralized retention, you must configure a diagnostic setting. - https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

    However, you can solve your requirement as follows:

    1. Use Azure Resource Graph to list all Microsoft.Compute/snapshots older than 30 days using properties.timeCreated.
         Resources
         | where type =~ 'microsoft.compute/snapshots'
         | extend snapshotTimeCreated = todatetime(properties.timeCreated)
         | where snapshotTimeCreated < ago(30d)
         | project snapshotId = id, snapshotName = name, resourceGroup, subscriptionId, location, snapshotTimeCreated
         | order by snapshotTimeCreated asc
         
      
      https://learn.microsoft.com/en-us/azure/governance/resource-graph/, and https://docs.azure.cn/en-us/governance/resource-graph/first-query-portal shows you how to.
    2. Use managed disk metadata to determine whether any current managed disk was created from a snapshot, because disks created with Copy expose properties.creationData.sourceResourceId, which can point to the snapshot ARM ID. Since Azure’s documented restore flow is snapshot → managed disk → VM, this is the correct linkage for “used to create a VM or disk.” https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/disks, https://learn.microsoft.com/en-us/rest/api/compute/disks/create-or-update?view=rest-compute-2025-11-01, https://learn.microsoft.com/en-us/azure/virtual-machines/scripts/create-managed-disk-from-snapshot
    3. If you need to know whether a snapshot was used historically in the last 30 days, including cases where the derived disk/VM was later deleted, you must rely on Azure Monitor Activity Log (90-day default retention) or on diagnostic settings that exported those logs to Log Analytics/Storage/Event Hubs. Without preserved control-plane logs, that historical answer cannot be reconstructed reliably after the fact. https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log, https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema, and https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings
    4. If your real objective is automatic snapshot retention and cleanup, do not treat manual snapshots as your backup platform; use Azure Disk Backup, which Microsoft documents as automating snapshot lifecycle management and retention for managed disks. https://learn.microsoft.com/en-us/azure/backup/disk-backup-overview and https://learn.microsoft.com/en-us/azure/backup/backup-managed-disks gibes more insight on how to.

    I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.


    Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
  1. Bharath Y P 8,495 Reputation points Microsoft External Staff Moderator
    2026-04-27T06:10:05.68+00:00

    You can absolutely do this end-to-end with Azure CLI. Here’s a 3-step pattern:

    1. Set up your subscription and calculate the 30-day cutoff
      
         az login
      
         az account set --subscription "YourSubName"
      
         # ISO timestamp 30 days ago
      
         THIRTY_DAYS_AGO=$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ)
      
      
    2. List snapshots older than 30 days
      
         az snapshot list \
      
           --query "[?properties.timeCreated<'$THIRTY_DAYS_AGO'].{Name:name, RG:resourceGroup, Created:properties.timeCreated, Id:id}" \
      
           -o table
      
      
    3. From those old snaps, filter out any that have been used as the source of a new disk/VM You detect “used” by checking if any managed disk’s properties.creationData.sourceResourceId equals the snapshot’s id. If there’s no match, it’s unused. Option A – pure CLI + a little shell logic:
      
         # get all old snap IDs
      
         OLD_SNAPS=($(az snapshot list \
      
           --query "[?properties.timeCreated<'$THIRTY_DAYS_AGO'].id" \
      
           -o tsv))
      
         for SNAP_ID in "${OLD_SNAPS[@]}"; do
      
           COUNT=$(az disk list \
      
             --query "[?properties.creationData.sourceResourceId=='$SNAP_ID'] | length(@)" \
      
             -o tsv)
      
           if [[ $COUNT -eq 0 ]]; then
      
             az snapshot show --ids $SNAP_ID --query "{Name:name, RG:resourceGroup, Created:properties.timeCreated}"
      
           fi
      
         done
      
      
      Option B – single Resource Graph query via CLI:
      
         az graph query -q "
      
           Resources
      
           | where type =~ 'microsoft.compute/snapshots'
      
           | where properties.timeCreated < ago(30d)
      
           | join kind=leftouter (
      
               Resources
      
               | where type == 'microsoft.compute/disks'
      
             ) on $left.id == $right.properties.creationData.sourceResourceId
      
           | where isnull($right.id)
      
           | project snapshotName=name, resourceGroup, timeCreated=properties.timeCreated
      
         " -o table
      
      

    Attribute to check:

    properties.creationData.sourceResourceId on the disk resource.

    If it’s never equal to your snapshot’s id, that snapshot wasn’t used to create a disk/VM in that period.

    Automating & scheduling beyond Azure Automation Runbooks:

    • Azure Logic Apps – use a Recurrence trigger + Azure Resource Graph connector (or an Azure CLI action) + built-in email/Teams connector to notify or invoke a deletion step.

    • Azure Functions – write a small Python/PowerShell function that runs the same Resource Graph or Compute SDK code, schedule via a Timer trigger.

    • Azure Backup Service – not for ad-hoc snapshots, but you can leverage backup policies (for VMs or File-shares) to manage snapshot frequency & retention automatically.

    Hope that helps!

    Reference List

    Azure VM backup – Database consistent snapshots

    Learn about Azure Backup services

    File-Snapshot Backups for Database Files in Azure

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.