Hi,
Hope everything is going well.
We can use SCCM status message to audit the collection and device changes. Specifically look at the one for "Collection Member Resources Manually Deleted ". For more details, please refer to:
How to find who deleted computer account from SCCM?
How To Audit SCCM Device Collection Changes
SCCM Audit Status Messages Track Who Deleted Modified Changed Settings
Please note: The links are not from Microsoft, just for your reference.
Feel free to contact me if you have any concerns/queries.
Best regards,
Simon
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
After the way you tag questions on Q&A is updated, for any "Microsoft Configuration Manager" related problem, you can tag it with "Microsoft Intune", and then "Microsoft Configuration Manager" as the child tag.