Question 148 of 642 from exam AZ-900: Microsoft Azure Fundamentals

You would use the Azure Activity Log, not Access Control to view which user turned off a specific virtual machine during the last 14 days.

Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more than 90 days in the past.

In this question, we would create a filter to display shutdown operations on the virtual machine in the last 14 days.

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit