Admin audit trail — who changed what

Admin audit trail

The Audit trail (in the sidebar, under Admin) is the accountability record for the people who administer the system. It answers a different question from the sync Logs:

• Logs — "what happened to this user's account?" (the sync engine's activity).
• Audit trail — "what did an admin change in the system?" — who, what, when, and from where.

It's designed for administrators, and for safeguarding/DPO and security reviews.

What's recorded

Each entry captures:

• Who — the admin who made the change (their name is snapshotted, so the record stays readable even if they're later renamed or removed).
• What — the setting or action, with the old value → new value where it applies: "Sam Gray changed MIS sync from on to off", "…changed the final provision date from 24 Jul 2025 to 24 Jul 2026".
• When — the date and time.
• From where — the IP address and, if configured, an approximate location (city/country level at best — treated as approximate, and blank when it can't be determined).
• Context — the device/browser (user-agent), under Details.

What's captured (the scope)

• Settings changes are the core: the sync toggles (MIS, Google, Entra, AD, Apple), the shared-domain and pre-admission settings, the provisioning-window dates, the Classroom policy, password and login options, and the school's domains/name. This is captured automatically wherever a setting is saved.
• User and group admin actions — the day-to-day management of individual people and groups: profile edits (name, username, role, account status, MIS id, the Smartsync lock), password resets and set-passwords, forced password changes, 2FA changes, QR-code generation, login windows, renames and moves between schools, group membership changes, Google-role changes, and group deletions. Simple field edits record the old → new value; password and other credential changes record that it changed, never the value.
• Bulk actions record one entry per affected user or group. A bulk action on 50 users is 50 individually-traceable entries — never a single rolled-up row — so every person is separately accountable and linkable.
• High-value actions beyond simple settings — for example regenerating the Active Directory connector token — are recorded too, and the list is extensible.

Everyday, low-value events (and machine-driven work like sync/provisioning runs) are deliberately not recorded here — that activity lives in Recent activity and the sync Logs — so this trail stays a signal, not noise.

Privacy and integrity

• Append-only. Entries can't be edited or deleted — that's the point of an audit trail. (Old entries are pruned on a retention schedule.)
• Secrets are never stored. When a credential changes — a password, a token — the trail records that it changed, never the value.
• IP and location are staff personal data. They're kept for a legitimate security/audit purpose, access is limited to administrators, and they're removed after the retention period. Location is derived from the IP, is approximate, and is only shown when a location source is configured.

Finding what you need

Filter by:

• Admin — "show me everything Sam changed."
• Setting or action — "who touched the sync settings?" (matches the field, the action, or the sentence).
• Date range — "what changed on this date / last month?"
• School — in MAT mode, narrow to one school (or see the whole authorised trust).

Jumping to the user or group

When an entry is about a specific user or group, expand its Details and use the Open user / Open group link to go straight to that record. If you administer more than one school, the link switches you into the entity's school first, so the edit page loads correctly — you never land on a permission error. If the user or group has since been deleted, the link is replaced with a short "no longer available" note rather than a broken link. (The link only appears for admins who can manage users and groups; everyone else still sees the entry, just without the shortcut.)

Related

• Recent activity — the human-readable feed of what's been happening to accounts.
• Sync status and logs — the technical event log.