I believe that whenever someone is loggin into the controller, an automatic recording session starts, in case on on-premise. I am not sure about the SaaS part. So you can compare the recorded sessions and cross check who had signed in as admin during the sessions which showed deleted tiers/nodes.
I hope this helped. I am open to any other alternative suggestions that might be a better way to solve this.
... View more
