User Audit History

Sometimes you need the history for one person rather than the whole tenant — for example to confirm who changed a user's email, role, or profile, or to investigate unexpected access. The audit log lets you narrow the full trail down to a single user.

How to view a user's history

Open the user menu (your name, bottom-left) → Settings → Audit Logs (under Observability) and filter to the user you're investigating. Each matching entry records the same details as any audit entry:

• Actor — the user who made the change.

• Time — when it happened.

• IP address — captured at the start of the session.

• Item — the record or field that changed.

• Before / after — the previous and new values (From → To).

You can review changes a user made as the actor, as well as changes made to that user's account by others.

Reading the IP address

The IP address is captured at session start. It isn't re-checked if the user later switches networks within the same session, so a single entry reflects where the session began — not necessarily where the user was at the exact moment of the change. Treat it as a session-origin signal, not a real-time location.

Related

• Audit Logs Overview — entry fields and event categories.

• Viewing Audit Logs — the audit-entry field reference.

• Audit Log Retention — how long a user's history is kept.

Gotcha: a user's entries are subject to the same retention windows as everyone else's — older history may have already been pruned.