Get Azure resource group creation time

Question

Intent: Know when a resource group was created for the first time. The client organization wants to report and act on resource group creation timestamps. This will be used in automation scripts.

Unfortunately there is no creation timestamp property on resource groups. Using Get-AzureRmResourceGroup returns objects like this:

ResourceGroupName : eastus2-something-rg
Location          : eastus2
ProvisioningState : Succeeded
Tags              :
ResourceId        : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/eastus2-something-rg

How do I retrieve the creation timestamp for a resource group?

Overexcite

Dead URL needs to be removed or updated: feedback.azure.com/forums/223579-azure-portal/suggestions/… – Hedvige

Removed the dead URL. – Overexcite

Answer 1

get creation date time of Azure Resource Group using below PowerShell cmdlets (AzRestMethod)

$subId = (Get-AzContext).Subscription.ID
((Invoke-AzRestMethod -Path "/subscriptions/$subId/resourcegroups?api-version=2020-06-01&`$expand=createdTime" -Method GET).Content|ConvertFrom-Json).value|select name,createdTime

Disaccord

Works for the resource group, does not work for managed AKS cluster, for example. – Rondon

Answer 2

Indeed, resource groups don't have a creation timestamp.

But management operations are recorded in logs, and these logs can be retrieved with the Get-AzureRmLog command.

Here is a PowerShell statement that goes through a subscription's resource groups and finds those that were created n or more days ago (from this gist):

$days = 7
$pointInTime = [DateTime]::Now.AddDays(-$days);
$horizon = $pointInTime.AddDays(-$days);

"===Removing resource groups created between $horizon and $pointInTime==="

# Get potential log entries
$logs = @()
$logs += Get-AzureRmLog -StartTime $horizon -EndTime $pointInTime -Status "Succeeded" -ResourceProvider "Microsoft.Resources" -WarningAction "SilentlyContinue" `
    | Select-Object ResourceGroupName, ResourceId, @{Name="EventNameValue"; Expression={$_.EventName.Value}}, @{Name="OperationNameValue"; Expression={$_.OperationName.Value}}, EventTimestamp, @{Name="HttpVerb"; Expression={$_.HttpRequest.Method}} `
    | Where-Object -FilterScript {$_.EventNameValue -EQ "EndRequest" -and $_.OperationNameValue -eq "Microsoft.Resources/subscriptions/resourcegroups/write" -and $_.HttpVerb -eq "PUT"} `
    | Select-Object -ExpandProperty ResourceGroupName -Unique

"Expired resource groups (created BEFORE $pointInTime) -> $logs"

# Get recent log entries to remove from the list
$nologs = @()
$nologs += Get-AzureRmLog -StartTime $pointInTime -Status "Succeeded" -ResourceProvider "Microsoft.Resources" -WarningAction "SilentlyContinue" `
| Select-Object ResourceGroupName, ResourceId, @{Name="EventNameValue"; Expression={$_.EventName.Value}}, @{Name="OperationNameValue"; Expression={$_.OperationName.Value}}, EventTimestamp, @{Name="HttpVerb"; Expression={$_.HttpRequest.Method}} `
| Where-Object -FilterScript {$_.EventNameValue -EQ "EndRequest" -and $_.OperationNameValue -eq "Microsoft.Resources/subscriptions/resourcegroups/write" -and $_.HttpVerb -eq "PUT"} `
| Select-Object -ExpandProperty ResourceGroupName -Unique

"Resource groups created AFTER $pointInTime -> $nologs"

# remove any that were found to have recent creation
$rgs = $logs | Where-Object {$nologs -notcontains $_} | Select-Object @{Name="ResourceGroupName"; Expression={$_}} | Get-AzureRmResourceGroup -ErrorAction "SilentlyContinue"

"Existing resource groups to delete -> $($rgs | Select-Object -ExpandProperty ResourceGroupName)"

$rgs | Remove-AzureRmResourceGroup -Force -AsJob

It returns a list of the jobs that are running to delete the resource groups (they can take some time depending on their contents).

Overexcite

The Azure audit logs contain data only for 90 days. Is there any way to fetch data (like RG created time) for RG created sometime last year?? – Obey

You could query the deployments. RGs are not recorded in the deployment log, but you could use the earliest resource deployed to the RG, maybe. Also, deployments can be deleted, so you risk that as well. – Overexcite

I appreciate the solution but it is hacky and makes a lot of assumptions that aren't obvious or inherently true. – Hedvige

@gigalul Indeed. And the Powershell modules in this answer from 4.5 years ago are now deprecated. – Overexcite

Answer 3

This information is available via ARM, but you have to call the API directly rather than the PS Get-AzureRmResourceGroup (or Get-AzResourceGroup) cmdlets.

See Deleting all resources in an Azure Resource Group with age more than x days

Essentially, you need to add the to the $expand=createdTime to your query parameters, ie.:

GET https://management.azure.com/subscriptions/1237f4d2-3dce-4b96-ad95-677f764e7123/resourcegroups?api-version=2019-08-01&%24expand=createdTime

Fermi

Works for the resource group, does not work for managed AKS cluster, for example. – Rondon

Answer 4

You can use az group deployment list -g [RESOURCE_GROUP_NAME] and then parse out the oldest "timestamp" value using any method you'd like.

Note that as of the time of this writing, az group deployment is implicitly deprecated and will be replaced by az deployment group.

Hedvige