VMSS instances unexpectedly stopped with no caller-bearing Activity Log event

Hello @Lisa Alexander

The key detail here is that Resource Health reports “UserInitiated – Stopping and deallocating.” Microsoft documents VirtualMachineDeallocationInitiated as an informational event indicating that an authorized user or process requested the deallocation. So UserInitiated doesn't necessarily mean a human manually stopped the VM.

Since these VMSS instances appear to be AKS nodes, I would specifically check the AKS node pool scaling configuration and cluster autoscaler. AKS can deallocate VMSS instances during scale-down when the node pool's scale-down-mode is configured as Deallocate.

For example, check:

az aks nodepool show \
  --resource-group <AKS-RG> \
  --cluster-name <AKS-Name> \
  --name <NodePool> \
  --query "{count:count,autoscaling:enableAutoScaling,min:minCount,max:maxCount,scaleDownMode:scaleDownMode}"

Also correlate the timestamps with node-pool scaling/autoscaler activity and query the Activity Log at both the VMSS and AKS-managed resource group levels rather than only looking at the individual instance.

The absence of a caller-bearing Administrative event is important. Resource Health and Administrative Activity Logs are different event categories, and the Resource Health event itself won't necessarily identify the originating identity/API call.

If you've confirmed there was no AKS autoscaler/node-pool operation, scheduled automation, policy, runbook, pipeline, or other management process at those exact UTC timestamps, then your request for backend correlation is reasonable. At that point, I would open an Azure support case and provide the VMSS resource IDs, instance IDs, exact UTC timestamps, Resource Health event/correlation IDs, and relevant AKS cluster/node-pool details. Microsoft Support can correlate those with internal Compute/AKS telemetry; this isn't something the community forum can retrieve.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.