How to Discover Who Deleted a Workspace in Azure
If your workspace has disappeared or been deleted, you can identify which user deleted it by checking the Activity log in the Azure portal.
- Go to the Activity log in the Azure portal.
- Expand the timeline to focus on when the workspace was deleted.
- Filter the log for a record of the specific event.
- Click on the event to display information about the event, including the user who initiated the event.
The screenshot shows how you can click the “Remove Databricks Workspace” or “Delete Cluster” events in the Operation Name column, and then view detailed information about the event.
If you are still unable to find who deleted the workspace, create a support case with Microsoft Support. Provide details such as the workspace id and the time range of the event (including your time zone). Microsoft Support will review the corresponding backend activity logs.