Azure AI API key compromise: Can Microsoft recover historical source IPs without diagnostic logs?

I am investigating suspected unauthorised API usage on an Azure AI resource and need guidance on whether Microsoft can help identify the source IP addresses.

Resource details

• Resource type: Azure AI Services / Microsoft.CognitiveServices/accounts

Resource name: AI-Startup-Sierra

Region: East US 2

Resource group: rg-ai-startup-dev

Incident window: 10–16 October 2026 UTC, particularly 13–15 October.

Azure Monitor metrics showed unusually high request volumes against the gpt-6-astra deployment. On 14 October, the resource recorded hundreds of thousands of successful requests and HTTP 429 throttling responses per hour, with more than one million requests reported in some hourly periods.

I checked the resource's diagnostic settings and associated Log Analytics workspace. Diagnostic settings were not enabled during the incident, and I could not find matching historical request-level logs.

I understand that Azure Monitor metrics can show request counts and usage patterns but do not normally identify the originating IP address.

My questions are:

Does Microsoft retain any backend service telemetry that could identify source IP addresses or network origins for requests to this resource during the incident window?

Can the Azure AI/Foundry service team investigate historical request metadata even when customer diagnostic logging was not enabled?

If this requires a paid technical support plan, which minimum plan provides the appropriate support channel?

If the historical IP information is unavailable, what evidence can Microsoft provide to help investigate the suspected unauthorised usage?

I am looking for the correct escalation path for a potential API-key security incident, rather than general instructions for enabling logging going forward.

I can provide exported Azure Monitor metrics and other supporting evidence privately through an appropriate Microsoft support channel if needed.I am investigating suspected unauthorised API usage on an Azure AI resource and need guidance on whether Microsoft can help identify the source IP addresses.

Resource details

Resource type: Azure AI Services / Microsoft.CognitiveServices/accounts

Resource name: AI-Startup-Sierra

Region: East US 2

Resource group: rg-ai-startup-dev

Incident window: 10–16 October 2026 UTC, particularly 13–15 October.

Azure Monitor metrics showed unusually high request volumes against the gpt-6-astra deployment. On 14 October, the resource recorded hundreds of thousands of successful requests and HTTP 429 throttling responses per hour, with more than one million requests reported in some hourly periods.

I checked the resource's diagnostic settings and associated Log Analytics workspace. Diagnostic settings were not enabled during the incident, and I could not find matching historical request-level logs.

I understand that Azure Monitor metrics can show request counts and usage patterns but do not normally identify the originating IP address.

My questions are:

Does Microsoft retain any backend service telemetry that could identify source IP addresses or network origins for requests to this resource during the incident window?

Can the Azure AI/Foundry service team investigate historical request metadata even when customer diagnostic logging was not enabled?

If this requires a paid technical support plan, which minimum plan provides the appropriate support channel?

If the historical IP information is unavailable, what evidence can Microsoft provide to help investigate the suspected unauthorised usage?

I am looking for the correct escalation path for a potential API-key security incident, rather than general instructions for enabling logging going forward.

I can provide exported Azure Monitor metrics and other supporting evidence privately through an appropriate Microsoft support channel if needed.