Audit Logs Overview

When multiple administrators, CSRs, or partners manage one tenant, configurations can change without everyone's knowledge. The audit log records those changes — giving a transparent, accountable history you can review for troubleshooting, security reviews, and compliance.

Open it from the user menu (your name, bottom-left) → Settings → Audit Logs (under Observability).

Reading an entry

Each entry captures:

• Time — when the change was made.

• Actor — the user who made it.

• IP address — where the change came from.

• Item — the record or field that changed.

• Type — the kind of change (for example Created or Field Updated).

• Before / after — the previous and new values (From → To).

How events are categorized

Behind the scenes, every event is bucketed into a category so it can be reviewed and retained sensibly:

• Authentication — sign-ins, sign-outs, and impersonation events.

• Security — permission, policy, and API key changes.

• Admin & Configuration — tenant settings, users, profiles, and integration changes.

• Data Access — reads, downloads, exports, and views.

• Data Changes — creates, updates, deletes, and other business activity.

• System — background jobs and platform-emitted events.

These categories drive retention: each can keep entries for a different length of time.

Retention

Entries don't accumulate forever. Control how long they're kept under Settings → Audit Log Retention — see Audit Log Retention. For a field-by-field reference of an entry, see Viewing Audit Logs.

Gotcha: older entries are pruned automatically once they pass their category's retention window, so export anything you need to keep for long-term records before it ages out.