User management activity log

This article explains the user management activity log.

Overview

The user management activity log provides access to downloadable CSV files that contain information within a given date range about the following user activities:

• Activities logged in Users and Partners.
• Activities logged in User Groups.
• Activities logged in Invites.
• Activities logged in Email sign-ins.
• Activities logged in Partner Access Requests.

Downloading the user management activity logs

1. Navigate to the Users section.
2. Click on More options.
3. Click on Activity log.
4. Tick the desired activity logs to be downloaded.
5. Set the time frame.
6. Click Download.

Activities logged in Users and Partners

The Users and Partners activity log files will display activities related to users or partners being created, updated, or deleted from the tenant. Each logged activity will contain the date of the activity, who performed the activity, who was affected by the activity, which user type was affected (internal, partner, or invited). Most activities will also display the details of the old value versus the new value.

The log file will contain the following information:

• Date: the date on which the activity took place.
• EntityType: the area of the activity.
  • UserAccess: relates to the role of the user or the partner.
  • Users: relates to user/partner creation, updates, authentication, or deletion.
• ChangedBy:  who performed the action.
  • UserName: a specific user on the tenant. 
  • SYSTEM: authentication or SCIM.
• AffectedId/AffectedName: displays the Id and Name of the user or the partner.
• AffectedUserType: 
  • Internal: the user is part of the Users tab.
  • Partner: the user is part of the Partners tab.
  • Invited: the user was invited to the tenant.
• Action: 
  • Created: the user was created on the tenant.
  • Updated: the user or the partner was updated (roles, claims).
  • Deleted: the user was removed from the tenant.
  • Revoked: the user or the partner access to the tenant was removed.
  • Assigned: the user or the partner was given access to the tenant.
• Difference: displays the details of the old value versus the new value or only the detail of the new value.

Activities logged in Users Groups

The Users Groups activity log files will display activities related to user groups being created, updated, or deleted from the tenant. Each logged activity will contain the date of the activity, who performed the activity, and which user group was affected by the activity. Most activities will also display the details of the old value versus the new value as well as the detail of the new value.

The log file will contain the following information:

• Date: the date on which the activity took place.
• EntityType: the area of the activity.
  • UserGroup: relates to user groups.
• ChangedBy:  who performed the action.
  • UserName: a specific user on the tenant. 
• AffectedId/AffectedName: displays the Id and Name of the user group.
• Action: 
  • Created: the user group was created on the tenant.
  • Updated: the user group was updated (name, description, filters).
  • Deleted: the user group was removed from the tenant.
    
• Difference: displays the details of the old value versus the new value or only the detail of the new value.

Activities logged in Invites

The Invites activity log files will display when an invite has been sent, resent, accepted, or deleted. Each logged activity will contain the date of the activity, who performed the activity, and which user was affected by the activity.

The log file will contain the following information:

• Date: the date on which the activity took place.
• Invitee: the email address of the user affected by the action.
• Invited: the email address of the user who performed the action.
• Status:
  • Invited: the invitation was sent to a user.
  • Accepted: the invitation was accepted by a user.
  • Deleted: the invitation was deleted by a user.
    (if “Status changed by” is empty, the user was deleted in the Users tab.
  • Resent: the invitation was resent to a user.
• Status changed by: the email address of the user who changed the current status, it can be either the sender's or receiver's email address.

Activities logged in Email sign-ins

In the Email sign-ins activity log we show the date of the activity and who signed in with Email authentication (either with the Email authentication method set on the tenant or as an invited user to the tenant).

The log file will contain the following information:

• Date: the date on which the activity took place.
• Email: the email address of the user who attempted to log in.
• Authentication method name: the email authentication id used If this column is empty, it means the user was invited to the tenant through the Invites tab.
• IP Address: the originating IP address.
• Country: the originating country.
• Status: Status of the authentication attempt.
  • Success: The provided credentials are correct.
  • Failure: Incorrect user credentials.
  • Blocked: Incorrect credentials were used 10 times in a row which leads to a temporary ban of the user account (email address).

Activities logged in Partner Access Requests

The Partner Access Requests activity log will display activities related to the partner access controls configured in the Security tab of the Account section of the Admin center. Each logged activity will contain the below information.

Each activity writes two records to the activity log: one record is written for the old state and one is written for the new state.

The log file will contain the following information:

• Date: the date on which the activity took place.
• EntityType: will always be 'PartnerAccessRequest'.
• ChangedBy: the name of the customer Admin who approved or denied the partner access request.
• AffeectedUserId: the user id of the partner that requested access.
• AffectedName: the name of the partner that requested access.
• Action: granted or denied partner access.
• Difference: new vs old state.
• ContectData
  
  • ExpirationDate: the expiration date (if applicable) of the partner access.
  • IsFromCoreSupportGroup: yes or no depending on if the partner is a within the core Templafy support group.
  • Id: user id of the partner that requested access.
  • Email: the email address of the partner that requested access.