Final answer:
To determine which user shut down an Azure VM, the Azure Activity Log should be consulted for records of such events, including user details and timestamps.
Step-by-step explanation:
To find out which user shut down a Virtual Machine (VM) in Microsoft Azure, the Azure Activity Log should be used. The Azure Activity Log provides a record of all control-plane events from the Azure Resource Manager, which includes actions such as starting and stopping VMs. You can filter the logs for shutdown events and find details about the user who initiated the action, the time of the event, and more.
In this context, Azure Policy is more about setting rules for resources, Azure Monitor provides performance and health monitoring, and Azure Security Center focuses on security management and threat protection. The Activity Log is the correct choice for tracking such user activities and system events.