> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/stonly-import-audit-logs/audit-logs.md). # Audit Logs The Audit Logs page records what was changed in your Augmentt portal, who changed it, and which customer it affected. When a policy appears in a customer tenant that nobody remembers deploying, or a client asks who authorised a change, this is where you answer the question. Find it at **Audit Logs** in the main menu. This is the Augmentt audit trail, not the Microsoft one. Audit Logs records actions taken by your system users inside the Augmentt portal. For sign-in activity and administrative changes made directly in the customer's tenant, use the Microsoft 365 audit log in Microsoft Purview. **Why it matters for compliance.** SOC 2, ISO 27001 and most cyber-insurance questionnaires ask for evidence that privileged administrative actions are logged and attributable. This page is that evidence for your Augmentt-mediated changes. ## What each entry records | Column | What it tells you | | ------------ | --------------------------------------------------------------------------------- | | Initiated by | The system user who performed the action | | Company | The customer the action affected | | Tags | Labels describing the area of the product involved | | Action | What kind of change it was — Create, Update, Delete, Enable, Disable, Add, Remove | | Summary | A plain-language description of the event | | Date | When the event happened | Actions are colour-coded so you can scan the list: creations and enablements read as positive, updates as cautionary, and deletions and disablements as destructive. ## Filtering the log The page filters on: * **Initiated by** — narrow to a single system user * **Company** — narrow to one customer * **Tags** — narrow to one product area * **Action** — narrow to Create, Update, Delete and so on * **Date** There is also an **Exclude NFR company** option, which removes your own internal not-for-resale tenant from the results so you see only real customer activity. Start with Company, then Action. For a customer question ("what changed in our tenant last week?"), filter by Company and set the date range. For an internal review ("what did we delete this month?"), filter by Action = Delete across all companies. ## Viewing the full detail of an event Select **View details** on any row to open Audit log details. This shows the complete record for the event, including the **Payload** — the raw data Augmentt recorded when the change was made. The payload is the authoritative record. The Summary column is a readable précis; the payload contains the actual values submitted. When you need to prove exactly what a policy looked like at the moment it was deployed, read the payload. ## Viewing the system user behind an event Select **View system user** to open System user details for the person who initiated the action, so you can confirm their role and access. If the account has since been removed you will see **User no longer exists**, along with: > This system user no longer exists. The audit log retains user details that were recorded when the event happened. This is deliberate and important. Deleting a system user does not erase their history. The audit trail keeps the identity details captured at the time, so offboarding a technician does not destroy the record of what they did. ## Collections and company scope Where an action applied to a collection of companies rather than a single one, the entry shows the collection name and the number of companies affected — for example "North Region Collection" and "14 companies". Bulk actions are one entry, not fourteen. When reviewing a change that hit a collection, check the company count so you understand the blast radius. See the Company Collections guide for how collections are built. ## Recommended review routine Audit Logs is most useful as a habit rather than a forensic tool: * **Weekly** — filter to Action = Delete across all companies and confirm every deletion was intentional. * **Monthly** — filter by each technician in turn and spot-check their activity, particularly anyone newly granted Manage permissions. * **At offboarding** — before removing a departing technician's system user, review their recent activity. * **On customer request** — filter by Company and the requested date range, and use View details to supply the payload if the customer needs specifics. ## Troubleshooting **An action I know happened is not listed** — confirm your filters, especially the date range and Exclude NFR company. Also confirm the change was made through the Augmentt portal; changes made directly in the Microsoft tenant are not recorded here. **Initiated by is empty** — the action was performed by an automated process rather than a person, for example a scheduled task. **The user shown no longer exists** — expected behaviour. The log retains the identity recorded at the time of the event. **I need sign-in history for a customer's users** — that is in the Microsoft audit log, not here. See the Multi-Factor Authentication Report and Threat Report for the identity signals Augmentt surfaces. ## Related guides * System Users and Permissions — who can do what in the portal * Company Collections — how bulk company scoping works * How Alerts Work — alerting on tenant-side security events --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/stonly-import-audit-logs/audit-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.