Deployment Failures Need Investigation? Inspect Errors, Activity Log, and Changes

A failed deployment message often wraps a more useful inner error. Deployment history shows the attempted template operation, Activity Log records management operations and their caller, and Change Analysis shows available before/after resource-property changes. Together they connect an error to its cause and surrounding changes.

This standalone lab uses an unattached network security group (NSG) and Azure Cloud Shell. It needs no VM or Log Analytics workspace. Use an account that can create resources in your lab subscription.

Prepare One Resource

In the Azure portal, create a Network security group:

Subscription: CloudTrips TEST
Resource group: rg-cloudtrips-monitor-deploy-test-weu
Name: nsg-ctdeployweu
Region: West Europe
Tag: labVersion = v1

Leave it unattached to any subnet or network interface. After creation, confirm its name and tag on the resource. Download inspect-monitor-nsg.json, open Cloud Shell → Bash, and upload the file with the shell’s Upload control.

The template has no resources to create. Its output reads an existing NSG by name. Its default name is intentionally wrong, allowing us to investigate a failed reference.

az account set --subscription 'CloudTrips TEST'
az deployment group create \
  --resource-group rg-cloudtrips-monitor-deploy-test-weu \
  --name inspect-nsg-failed \
  --mode Incremental \
  --template-file inspect-monitor-nsg.json

Read the Actual Error

Expect a failed deployment referring to nsg-ctdeploy-missing. Open Resource group → Deployments → inspect-nsg-failed → Error details. Expand the error until you find the missing resource’s ID and message; the useful code is typically ResourceNotFound, sometimes wrapped in an output-evaluation error.

An output evaluation can fail even when there is no failed resource-creation row. Inspect the deployment’s overall error and Inputs as well as its operation details. Compare the submitted nsgName with the resource actually present in the group.

Screenshot 1: Failed deployment details identifying the missing NSG name/resource ID.

Open the resource group’s Activity log, select Last hour, and inspect the failed deployment write operation. Check status, caller, timestamp, and correlation ID. Its JSON/event details provide the underlying operation context. Align portal/local timestamps with UTC when comparing records.

Screenshot 2: Activity Log event for the failed deployment with status, caller, and correlation ID.

Correct and Verify

In Cloud Shell, run a second deployment with the actual resource name:

az deployment group create \
  --resource-group rg-cloudtrips-monitor-deploy-test-weu \
  --name inspect-nsg-fixed \
  --mode Incremental \
  --template-file inspect-monitor-nsg.json \
  --parameters nsgName=nsg-ctdeployweu \
  --query properties.provisioningState --output tsv

Expect Succeeded. Open Deployments → inspect-nsg-fixed → Outputs and inspect inspectedNsg. The two named deployments preserve the failed and corrected attempts for comparison. Check the original error before retrying a real deployment: a missing resource, insufficient quota, denied permission, and unavailable regional capacity require different fixes.

Inspect a Recent Change

Open nsg-ctdeployweu → Tags, change labVersion from v1 to v2, and save. Note the time. Search the Azure portal for Change Analysis, filter to the lab resource group and recent time range, and open the NSG update after it appears. Inspect the changed properties and find the tag’s before/after values.

If the change list has not populated, wait a few minutes. You can also use Azure Resource Graph Explorer, scoped to your subscription:

resourcechanges
| extend ChangeTime=todatetime(properties.changeAttributes.timestamp),
         Target=tostring(properties.targetResourceId),
         ChangeType=tostring(properties.changeType)
| where ChangeTime > ago(1d)
| where Target endswith "/networkSecurityGroups/nsg-ctdeployweu"
| project ChangeTime, ChangeType, Target,
          ChangedBy=properties.changeAttributes.changedBy,
          Changes=properties.changes
| order by ChangeTime desc

Expand Changes for the update and inspect tags.labVersion. Run this in Resource Graph Explorer; resourcechanges belongs to Resource Graph.

Screenshot 3: Change Analysis or Resource Graph result showing labVersion changing from v1 to v2.

Resource Graph change history is available for 14 days; Activity Log is retained for 90 days by default. Change Analysis tracks supported management-plane resource properties. The available record determines which old/new values you can inspect. A failed attempt can appear in Activity Log without a corresponding property change.

Finish

Delete rg-cloudtrips-monitor-deploy-test-weu when you have finished reviewing the three views. This removes the dedicated NSG and its resource-group deployment history. Keep the monitoring workspaces from other Trips only if you still need them.