Track a Network Watcher capture file beyond the capture resource

Source facts

A completed Network Watcher packet capture can be stored in Azure Storage, on the target VM, or in both locations selected at creation. For a capture written to Azure Storage, the file may remain in a temporary location and appear in the storage account container only after the session completes.

Deleting the packet-capture resource in Network Watcher does not delete the file from either the storage account or VM. Microsoft requires separate file deletion when that captured data is no longer needed. Microsoft Learn.

Applicability

Identify the target, configured destinations and authorized investigation before handling a capture. For Azure Storage, keep a running session’s temporary output distinct from a finalized evidence file.

DSE recommendation

DSE recommends a capture register that records where every copy is expected and who controls its retention. Preserve required evidence before authorizing cleanup. Do not close a data-removal task merely because the capture no longer appears in Network Watcher. Conversely, do not conclude that collection failed solely because an active session’s Azure Storage file is not yet visible in its final container.

Verification

After the session completes, verify the expected file in each configured destination and confirm it contains the authorized test traffic. For an approved cleanup, check the actual files separately from the capture resource. Retain the observed outcome and any remaining copy as an explicit follow-up item. Do not remove investigation material until its owner has confirmed that retention requirements are satisfied.

Official references

Microsoft Learn: Manage Packet Captures. Source retrieved September 9, 2026.