So I have an AKS cluster and it had been connected to log analytics workspace in a different resource group, namely DefaultResourceGroup-NEU. Apparently someone or something deleted that resource group from the subscription and caused AKS to complain about it.
I know resource groups are not recoverable, which is fine - it was a DEV environment. However, I'd like to know if there is an easy way to check who and when deleted that resourece group which took log analytics workspace with it.
Go to your subscription in Azure Portal, then go to Activity log. It will show a "Delete resource group" operation for the resource group delete.