We recived an alert for a vm but the vm has been deleted from the tenant

Hello Christopher Johnson,

When a VM is deleted, it can sometimes take a little while for the alerts to process and stop triggering, especially if there were pending activities or operations associated with it. Regarding your question about the timeframe for receiving such alerts, this can vary based on several factors like the alert type and the underlying infrastructure's state at the time of the VM’s deletion.

Here's what you can do to investigate this further:

Check Activity Log Alerts: These can provide insights into any recent actions taken on the VM and can help confirm whether notifications about previously deleted VMs have delayed processing. You can configure alerts for events such as VM deletions using Activity Logs.

Review Recommended Resource: You can follow the recommendations outlined in the documentation for monitoring VMs using Azure Monitor alerts. It includes steps for configuring notifications and ensuring you're on top of alerts moving forward. Here’s a good starting point - Best Practices for VM Monitoring.

Expected Behavior: Often, alert information may continue to be reported for a few minutes to hours after the VM has been deleted, as it can take some time for the changes to propagate throughout Azure's monitoring services.

Here are a couple of resources you might find helpful:

• Azure Monitor Alerts Overview
• Common Alert Rules for VMs

If you still facing the issue, Kindly share the screenshot for us to investigate further?

We are still receiving alerts even though it has been more than 24 hours on a VM that has been deleted

Hello Christopher Johnson,

For the scenario Alert retention (why you still see alerts after the VM is deleted)

Security alerts remain visible for up to 90 days in Defender for Cloud—even if the associated resource has been deleted. This is by design so investigations aren’t lost if the asset was removed. Visibility and downstream notifications (e.g., exports to Sentinel/Logic Apps/email) can therefore continue unless you dismiss or suppress them.

Attack path re‑evaluation (when the “attack path” tile clears)

After you break the path (e.g., delete the VM, remove its public exposure, or remediate vulnerabilities), Defender for Cloud’s graph re‑evaluations are not instantaneous. Attack paths can take up to ~24 hours to disappear from the dashboard once all linked recommendations are resolved. If you’re still seeing new notifications after that window, it’s typically due to alert retention or a related resource still meeting the path conditions.

Also follow the below checklist has been met.

Verify there are no remaining network artifacts (public IP, LB, NSG rule) linked to the deleted VM’s RG/subscription.

In Defender for Cloud, open the alert, select View full details → check Affected resources and Insights to spot any other node keeping the path active (e.g., a managed identity or key vault referenced by the path). Remediate or confirm deletion.

Set alert Status = Dismissed for investigated items

If noise persists and is non‑actionable, add a suppression rule with an end date (e.g., 30 days)

When will you get “another” alert? If the original alert hasn’t been dismissed/suppressed and your export/notification pipeline forwards status changes, you can continue receiving notifications for up to 90 days even though the VM is gone. Clearing the attack path view itself should happen within ~24 hours after the last dependency is remediated.

Reference Document:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview

Hope this answers your questions, If you have further queries let us know.