- To track user account deletions, log in to your Microsoft Azure portal → Navigate to "Azure Active Directory" → Go to "Users and Groups" → Click "Audit Logs" → Filter the audit log by the "Delete user" activity → Click on the last event with the "Delete user" activity.
- To find out who deleted a user from your Azure AD, refer to the "Actor" section. To find out which accounts were deleted, refer to the "Target" section.

- Run Netwrix Auditor → Navigate to "Reports" → Expand the "Azure AD" section → Select "User Accounts Created and Deleted Directly in Azure AD" → Click "View" → Set the "Actions" filter to "Removed only" and click "View Report".

- To save the report, click the "Export" button → Choose a format from the dropdown menu → Click "Save".