I have received some email notifications from Azure, containing this:
Activity log alert Alert [Server Name] Health Status
Properties {
"title":"Reboot initiated from inside the machine",
"details":"A reboot was triggered from inside the virtual machine. This could be due to a virtual machine operating system failure or as requested by an authorized user or process. The virtual machine will be back online after the reboot completes.",
"currentHealthStatus":"Unavailable",
"previousHealthStatus":"Unavailable",
"type":"Downtime",
"cause":"UserInitiated" }
This definitely was not 'UserInitiated' but could have been caused by Windows Update as the time falls within the 'out of hours' window defined.
However, is there any way to tell in the logs what triggered the reboot?