The SaaS audit log records every provisioning, sync and connection event across all your SaaS. Use it to follow what happened to an account and to retry anything that failed.
Feature/Functionality
Overview
SaaS > Audit Log gathers the events of every SaaS in one place. Each SaaS also has its own Logs tab, which you reach from SaaS > Directory.
The log covers three kinds of event:
- Provisioning: a user provisioned, updated or deprovisioned, a password reset, and changes to a user's groups, roles, licences or organisational units.
- Syncs: users, groups, roles, licences and organisational units synced, plus SaaS activity synced.
- Connections: API connected or disconnected, SSO connected or disconnected, AI agent configured or disconnected.
Every event lists its Date, Event, App, Employee, Context, Initiator and Status.
How to use
- Go to SaaS > Audit Log.
- Filter by Event, Status, Context (Onboarding, Offboarding or Regular sync), Employee or SaaS.
- Click Refresh to pull in the latest events.
Retry a failed event
- Find the failed event in the list.
- Open its actions.
- Read the error details, then retry it.
Tips and Best Practices
- Filter by Status to find failures. It is the fastest way to see what needs a retry.
- Filter by Context to check one process. Onboarding, Offboarding and Regular sync each have their own value.
- Read the error before you retry. The error details tell you what went wrong.
- Use the Logs tab for a single SaaS. It saves filtering the global log.
Troubleshooting and FAQ
Troubleshooting
- A recent event does not appear. Click Refresh to load the latest events.
- A provisioning event failed. Open its actions, check the error details and retry it.
FAQ
-
Is this the same as the MDM audit log?
No. This log covers SaaS events only. Device management actions have their own audit log.
-
Can I see the events of just one SaaS?
Yes. Filter by SaaS, or open the SaaS from SaaS > Directory and use its Logs tab.
-
Who started an event?
The Initiator column shows it.