StorageDelete logs not appearing in StorageBlobLogs or insights-logs-storagedelete despite diagnostic settings enabled

Question

StorageDelete logs not appearing in StorageBlobLogs or insights-logs-storagedelete despite diagnostic settings enabled

Lithesh R Poojary 0

Hi Team,

I have been trying to set up an alert for blob deletions

on Azure Storage Account using Log Analytics workspace

(StorageBlobLogs). Despite spending several hours

troubleshooting, DeleteBlob operations are simply not

getting logged anywhere.

WHAT IS WORKING:

PutBlob (uploads) ARE being logged correctly
GetBlobServiceProperties, GetContainerProperties are being logged
Diagnostic settings show as Enabled on blob sub-resource

WHAT IS NOT WORKING:

DeleteBlob never appears in StorageBlobLogs
insights-logs-storagedelete container was NEVER created when archiving to storage account
insights-logs-storageread and insights-logs-storagewrite containers exist and have data

EVERYTHING I HAVE CHECKED AND RULED OUT:

StorageDelete category IS checked in diagnostic settings
Soft delete for blobs = DISABLED
Soft delete for containers = DISABLED
Blob versioning = DISABLED
Blob change feed = DISABLED
Classic diagnostic settings = DISABLED (Status = Off)
No Data Collection Rules exist in the subscription
Tested deletion via Azure Portal AND Azure CLI
Deleted and recreated diagnostic settings multiple times
Used allLogs category group instead of individual categories - same result
Reproduced on TWO different storage accounts

KEY OBSERVATION:

The insights-logs-storagedelete container is never created

even when archiving logs to a storage account destination.

This suggests Azure backend is not generating StorageDelete

logs at all for these accounts.

REFERENCE:

Similar issue found here but root cause was a DCR

transformation filter - which we have ruled out:

https://learn.microsoft.com/en-us/answers/questions/1822342/adls-gen2-access-logs-via-diagnostic-settings

QUESTION:

Has anyone else faced this issue where StorageDelete

category simply does not generate any logs? Is there

a known issue with Central India regionAny suggestions would be greatly

appreciated.

Siva shunmugam Nadessin 9,625 Reputation points Microsoft External Staff Moderator

2026-05-04T00:58:36.8866667+00:00
Hello Lithesh R Poojary,

Thank you for reaching out to the Microsoft Q&A forum.

When investigated below are the few things to consider.

Double-check where your logs actually land

If you’re sending diagnostics to Log Analytics, they show up in the AzureDiagnostics table (not a table called “StorageDelete” or “StorageBlobLogs”). Try a query like:

AzureDiagnostics | where ResourceProvider == "MICROSOFT.STORAGE" | where Category == "StorageDelete" | where OperationName == "DeleteBlob" | sort by TimeGenerated desc

If you’re archiving to a storage account, note that the insights-logs-storagedelete container only gets created when the very first delete log arrives. So it’s “normal” not to see the container until a DeleteBlob entry is actually emitted.

Test with soft delete turned on

As a quick litmus test, turn Soft Delete for blobs back on (even with a 1-day retention). Now issue a DeleteBlob call and see whether you get a “BlobSoftDeleted” event in your logs. If that shows up, it proves the service is emitting something and may point to a backend filtering issue for permanent deletes.

Consider Event Grid as a reliable workaround

Storage’s built-in Event Grid integration will fire a BlobDeleted event for every delete, whether soft or permanent. You can route those to a Logic App, Function, Event Hub or even your Log Analytics workspace today and build your alert on top of those events.

Validate region/backend behavior

You mentioned Central India. Can you spin up a quick storage account in another region (e.g. West Europe or East US) with the exact same diagnostic settings and retry? If deletes show up there, we’re definitely looking at a regional Azure backend issue.

When you’re ready to escalate

If all of the above still yields zero DeleteBlob logs, please open a standard Azure Support ticket so the Storage engineering team can look at backend logging pipelines in Central India. Include: • Subscription ID, resource group & storage account name • Time stamps of your test deletes • Request-ID (if possible) from the client side

Let me know if any further queries - feel free to reach out!

References

• Creating and configuring diagnostic settings: https://docs.microsoft.com/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal#creating-a-diagnostic-setting

• Storage resource logs destinations: https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings#destinations

• Query resource logs in Log Analytics: https://docs.microsoft.com/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal#analyzing-logs

• BlobDeleted events via Event Grid: https://docs.microsoft.com/azure/storage/blobs/storage-blob-events-overview
Siva shunmugam Nadessin 9,625 Reputation points Microsoft External Staff Moderator

2026-05-05T05:22:02.32+00:00

Hello Lithesh R Poojary,

Just checking in to see if the solution shared above help you to resolve your issue. please reach out to us If you have any further questions.

Thanks

1 answer

Your answer

Siva shunmugam Nadessin 9,625 Reputation points Microsoft External Staff Moderator

2026-05-05T05:22:02.32+00:00

Hello Lithesh R Poojary,

Just checking in to see if the solution shared above help you to resolve your issue. please reach out to us If you have any further questions.

Thanks

Answer 1

StorageDelete logs for Azure Storage are only emitted and collected when:

A diagnostic setting exists on the correct resource scope (the storage account/blob sub‑resource), and
The StorageDelete category is selected and routed to at least one destination (Log Analytics, storage, or Event Hubs), and
Azure Monitor resource logs are actually being generated and routed by the platform.

From the described behavior:

StorageRead/StorageWrite are flowing correctly to both Log Analytics (StorageBlobLogs) and the insights-logs-storageread / insights-logs-storagewrite containers.
The insights-logs-storagedelete container is never created, and DeleteBlob never appears in StorageBlobLogs.

Given that:

Diagnostic settings must be explicitly created per resource and per category. Resource logs are not collected or stored until a diagnostic setting is created and categories are selected.
When archiving to a storage account, Azure automatically creates the destination containers per category only when logs for that category are actually emitted.

The combination of:

StorageRead/StorageWrite containers existing with data, and
StorageDelete container never being created,

indicates that the platform is not emitting StorageDelete resource logs for those DeleteBlob operations, even though the category is selected. This aligns with the key observation that the backend is not generating StorageDelete logs for the affected accounts.

The provided context does not document any regional limitation or known issue specific to StorageDelete in Central India, nor any additional configuration beyond diagnostic settings that would be required to get StorageDelete logs. It only states that:

Resource logs are generated automatically by the resource, but not collected until diagnostic settings route them.
Categories for storage include StorageRead, StorageWrite, and StorageDelete, and all are configured the same way in diagnostic settings.

Because StorageRead/StorageWrite are working with the same diagnostic setting and destinations, and StorageDelete is not appearing anywhere (Log Analytics or storage), this scenario matches a backend/platform issue rather than a configuration problem that can be resolved from the documented guidance.

The next step is to open a support case with Microsoft, referencing:

The storage account names and subscription IDs.
The region (Central India).
Confirmation that StorageRead/StorageWrite logs are present while StorageDelete logs are not, despite StorageDelete being enabled in the same diagnostic setting.

Support can then verify whether there is a service-side issue with StorageDelete emission for that region or those accounts.

References:

Share via

StorageDelete logs not appearing in StorageBlobLogs or insights-logs-storagedelete despite diagnostic settings enabled

1 answer

Your answer