Access Control Activity log

Use the Access Control Activity log to investigate recorded account, role, permission, sign-in setting, provider and session activity in your workspace. Read the event context and recorded changes together before drawing a conclusion.

Access needed

Access depends on your assigned permissions and workflow scope.

Read/filter workspace Access Control events, compare changes and export the loaded page: audit.read
User, role and sign-in settings management do not substitute for audit.read. This is tenant history, not platform-wide history.
Role and permission labels
Typical responsibility: Authorized investigator. Role names alone do not grant access.
Read the service Activity log
Resolve user and role names through optional lookups: All:identity.users.manageidentity.roles.read
These grants support their respective name lookups; they are not additional requirements for reading the event history. Unresolved references can remain IDs.
Role and permission labels
Typical responsibility: Authorized access administrator. Role names alone do not grant access.
Manage workspace user accounts and assignments
Read roles and the permission catalogue

Demo screenshots may show broader access than your account.

Open workspace history

Open Access Control → Activity log. The list shows Action, Entity type, Occurred, Actor, Entity, Subject and Changes. These describe different parts of an event; the person affected is not always the person who performed it.

Access Control Activity log with fifteen demo events — Read-only demo history; current account access must be checked separately.

Column	How to read it
Action	The recorded operation, such as Created or Updated.
Entity type	The kind of record affected, such as User or User role assignment.
Occurred	When the event was recorded; inspect the full time when comparing events.
Actor	The recorded caller or process.
Entity	The affected record, which can be an account or another reference.
Subject	The associated person or recorded subject where available.
Changes	The number of recorded field changes, not the number of affected users.

Find the relevant event

Choose the record context
Open Filter records. Narrow Entity type and Entity when investigating a particular account, assignment or role.
Distinguish caller from affected person
Use Actor to investigate who acted and Subject for the associated person. Use Action to narrow the operation.
Set the time range
Use From date and To date. Compare full occurrence times and keep the end on or after the start.
Check the remaining scope
Review active filter chips and pagination. Remove filters or Reset when the search is too narrow. A failed load is different from an empty result.

Access Control Activity log filter menu — Read-only demo history; current account access must be checked separately.

Inspect an event's references

Select an event and open Details. Review Occurred, Action, Actor, Entity type, Entity, Subject and their recorded IDs. Keep the Event ID when asking an authorized administrator to investigate the same occurrence.

Identity event Details showing recorded references and event ID — Read-only demo history; current account access must be checked separately.

A friendly name is easier to read, while a recorded ID helps identify the exact account or record. Some references remain IDs when a name is unavailable. Do not assume an account ID is an employee number.

Compare recorded changes

Open Changes, search changed fields or values if needed, and expand Compare for a field. Read Before and After together.

Expanded Last Sign In At before and after comparison — Read-only demo history; current account access must be checked separately.

In this demo event, the changed field is Last Sign In At. This supports reading the event as a recorded sign-in timestamp update; it is not evidence that someone changed the user's role or employee link. Raw change values may use a different timestamp representation from the localized occurrence time.

Export the loaded page carefully

Export page CSV covers the currently loaded page of filtered events. It does not export every matching page or replace the event comparison view. Check filters and pagination before exporting, and follow your organization's rules for storing and sharing account history.

Keep investigation separate from administration

Reading the log does not grant account changes, role changes or session termination. Use Manage users and employee links, Manage roles and permissions or Workspace sign-in settings for the corresponding operation and its requirements.

Troubleshooting

Problem	What to check
The log is unavailable	audit.read is separate from user, role and sign-in settings management.
A name appears as an ID	Name lookup may be unavailable; use the recorded reference and Event ID.
Actor says Anonymous	Inspect the event and changed fields; the label alone does not identify a person.
Current access differs from an event	Check later events and the current account's complete role assignments.
No result appears	Check filters, dates, pagination and request errors.
CSV is incomplete	Export page CSV covers only the loaded page.

What was verified

The populated 15-event list, filter menu, event Details and expanded Last Sign In At comparison were inspected in light theme. No export or account, permission, setting or session change was performed. Restricted-account access was not tested.