What counts as a "microsoft.compute/virtualmachines/write" event?

Question

What counts as a "microsoft.compute/virtualmachines/write" event?

NicholasMarshall-8741 0

We currently have an event grid/logic app setup to send an email when a virtual machine is deleted and we want it to also tell us when a virtual machine has been resized.

I have found from my testing that resizing a virtual machine and adding a new disk falls under the write event but I cant find clear documentation on all the events that fall under the virtualmachine/write category.

If possible I would also like to extract details from the event so it can tell us the specific write event that has happened but all I can find is the event data in the form of non-human readable JSON jargon.

0 comments

1 answer

Your answer

Answer 1

To extract human-readable details such as a virtual machine resize or disk addition, add a Parse JSON action in Azure Logic Apps after the Event Grid trigger. The Microsoft.Compute/virtualMachines/write category is a broad event type that captures VM creation and update operations. You can identify the specific action by evaluating the operationName field and inspecting the properties inside the JSON event payload.

The Microsoft.Compute/virtualMachines/write event commonly includes operations such as VM resizing, attaching or detaching data disks, and updating VM settings. For example, a resize operation appears as a write event where the hardwareProfile.vmSize value changes. Adding or removing disks is also recorded under the same write category, with changes reflected in storageProfile.dataDisks. Updates to the OS profile, such as administrative credential changes, also use the write operation. Some actions, such as reimage or redeploy, may appear under separate operations like Microsoft.Compute/virtualMachines/reimage/action or redeploy.

To make the event details readable, add a Parse JSON action after the Event Grid trigger in the Logic App. Set the content to the event body (or the data property depending on the trigger schema). Use a sample Event Grid payload from a VM resize or update operation to generate the schema automatically.

Once the JSON is parsed, add a Condition action to identify the specific operation type. For example, you can evaluate the expression:

@triggerBody()?['data']['operationName']

and compare it against:

Microsoft.Compute/virtualMachines/write

After identifying the write event, you can use additional conditions or Compose actions to inspect values such as hardwareProfile.vmSize or storageProfile.dataDisks. This allows the Logic App to determine whether the VM was resized, had disks added, or underwent another configuration change.

You can create a cleaner email notification by using the parsed properties instead of sending the raw JSON payload. The Parse JSON action exposes fields like VM name, VM size, disk details, and resource group as dynamic content. This allows you to build a human-readable email describing what changed on the virtual machine.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin