---
title: "Audit Log"
slug: "audit-log"
updated: 2026-07-24T08:22:21Z
published: 2026-07-24T08:22:21Z
canonical: "docs.discngine.com/audit-log"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.discngine.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

# Audit Log

## Overview

The Admin Center keeps an **audit log**: a permanent, read-only record of the significant actions taken in your organisation — who did what, to what, and when. It exists for accountability and troubleshooting.

Every event belongs to an organisation, and you only ever see your own organisation's events. What you can see also depends on your role: an Organisation Administrator sees the whole organisation, while an Application Administrator sees the events for the application(s) they manage.

## What is recorded

Events are grouped into categories. The main ones:

| Category | Example events |
| --- | --- |
| Authentication | sign-in to an application, password set-up email sent, password changed |
| User management | user created / updated / locked / unlocked / deleted; Organisation Administrator granted or revoked |
| Licence | licence assigned / revoked |
| Group management | member added / removed, role added / removed |
| Application | trial requested |
| Identity provider | provider created / updated / deleted, enabled / disabled for an application |
| IP access control | ACL created / updated / deleted, enabled / disabled for an application |
| Administration | access role granted / revoked, access reviewed |

Each event captures the **actor** (the person who performed it; automated actions are recorded as the system), the **target** (the entity affected, with a label that remains readable even if the entity is later deleted), the **organisation** and **application** in scope, the **timestamp**, a **details** summary (for example the users, licences, groups or role involved), and — for actions taken through the web interface — the **client IP address**.

## Sign-in events

Most events come from the actions performed inside the Admin Center. **Sign-ins are slightly different**: they are reported by the sign-in system for every login across all Discngine applications. When a sign-in can be matched to an application the Admin Center manages, it is attributed to that application; sign-ins that can't be matched to a managed application are still recorded, just not attributed to one. Sign-ins to the Admin Center itself are captured too.

## Viewing the log

Open **Audit Log** from the navigation menu. It shows:

- **Logins by application** — a bar chart of sign-ins per application and environment.
- **A count of unattributed sign-ins** — "+ N sign-in(s) not attributed to a managed application", for logins that couldn't be matched to a managed application (they still appear in full in the table below).
- **Audit events** — a searchable table of every event: timestamp, category, description, actor, target, application and details. You can filter it by **environment** and **date range** (the last 30 days by default) and **export** it (CSV, Excel, PDF or HTML).

Timestamps are shown in your organisation's configured timezone.

## Retention

The audit log is **permanent** — events are never edited or deleted, and there is no scheduled clean-up. Records are kept indefinitely.

## Who can view it

Viewing the audit log requires an administrative role — **Organisation Administrator** or **Application Administrator** — each seeing only the events within their scope. See [Access Roles](/public/docs/access-roles).

## Related

- [Access Roles](/public/docs/access-roles) — who can see what
- [Notifications and Emails](/public/docs/notifications-and-emails) — proactive alerts, as opposed to the after-the-fact audit trail