AuditLogs
| where TimeGenerated > ago(1d)
| where OperationName == "Delete conditional access policy"
| extend DeletedPolicy = tostring(TargetResources[0].displayName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend ActorIP = tostring(InitiatedBy.user.ipAddress)
| project TimeGenerated, Actor, ActorIP, DeletedPolicy, CorrelationId
| sort by TimeGenerated desc