# Audit Log
Overview
The Admin Center keeps an audit log: a permanent, read-only record of the significant actions taken in your organisation — who did what, to what, and when. It exists for accountability and troubleshooting.
Every event belongs to an organisation, and you only ever see your own organisation's events. What you can see also depends on your role: an Organisation Administrator sees the whole organisation, while an Application Administrator sees the events for the application(s) they manage.
What is recorded
Events are grouped into categories. The main ones:
| Category | Example events |
|---|---|
| Authentication | sign-in to an application, password set-up email sent, password changed |
| User management | user created / updated / locked / unlocked / deleted; Organisation Administrator granted or revoked |
| Licence | licence assigned / revoked |
| Group management | member added / removed, role added / removed |
| Application | trial requested |
| Identity provider | provider created / updated / deleted, enabled / disabled for an application |
| IP access control | ACL created / updated / deleted, enabled / disabled for an application |
| Administration | access role granted / revoked, access reviewed |
Each event captures the actor (the person who performed it; automated actions are recorded as the system), the target (the entity affected, with a label that remains readable even if the entity is later deleted), the organisation and application in scope, the timestamp, a details summary (for example the users, licences, groups or role involved), and — for actions taken through the web interface — the client IP address.
Sign-in events
Most events come from the actions performed inside the Admin Center. Sign-ins are slightly different: they are reported by the sign-in system for every login across all Discngine applications. When a sign-in can be matched to an application the Admin Center manages, it is attributed to that application; sign-ins that can't be matched to a managed application are still recorded, just not attributed to one. Sign-ins to the Admin Center itself are captured too.
Viewing the log
Open Audit Log from the navigation menu. It shows:
- Logins by application — a bar chart of sign-ins per application and environment.
- A count of unattributed sign-ins — "+ N sign-in(s) not attributed to a managed application", for logins that couldn't be matched to a managed application (they still appear in full in the table below).
- Audit events — a searchable table of every event: timestamp, category, description, actor, target, application and details. You can filter it by environment and date range (the last 30 days by default) and export it (CSV, Excel, PDF or HTML).
Timestamps are shown in your organisation's configured timezone.
Retention
The audit log is permanent — events are never edited or deleted, and there is no scheduled clean-up. Records are kept indefinitely.
Who can view it
Viewing the audit log requires an administrative role — Organisation Administrator or Application Administrator — each seeing only the events within their scope. See Access Roles.
Related
- Access Roles — who can see what
- Notifications and Emails — proactive alerts, as opposed to the after-the-fact audit trail