In that case, Activity logs will help, as any activity happens in VMs through the portal, you will get log alerts store in the activity logs, so you will go to activity logs and found that who has rebooted the VM and can share with clients after manager approval.