Realsmart Help

All guides / Mat

Trace a user's activity across the trust

A person can have an account in more than one school in your trust. When something goes wrong for them, such as a Google account not provisioning or an Entra error, you would otherwise open each school's logs separately and stitch the picture together. User log trace does that for you: one search, the whole trust, in a single timeline.

It follows a simple path: discover, surface, fix.

Before you start

  • You must be in MAT mode (the school switcher at the top of the page shows All schools), and be an admin who can reach more than one school.
  • Your admin access must include View logs & audit trail. An admin on the Reduced level doesn't have it, so User log trace is missing from their sidebar. See Reduced admin access.
  • You only ever see the schools you can reach, never beyond your trust.

How a user is matched across schools

The trace matches a person by their username, exactly. A username is the part of the Google or Entra email before the @ (username@school-domain), so it's the same key the cloud platforms use and the most reliable way to tie the same person together across schools.

Check the identities. A username can, rarely, belong to two different people in two different schools. The page shows every matched record (school, name, role, status), so you can confirm they're the same person before you trust the combined timeline. If a person has a different username in each school, trace each username separately.


Steps

Step 1: Open the trace

In the MAT sidebar, under Users & Groups, select User log trace. Or, from Find a user, select Trace on any row to open the trace for that username straight away.

Step 2: Search the user

Type the exact username (for example aaron.cooper) in the Username box. The results update as you type. Narrow the view with:

  • Time window — Last 24 hours, Last 7 days, Last 30 days (the default) or Last 90 days.
  • Platform — All, Google Workspace, Microsoft Entra, Active Directory, MIS / Wonde, Fetch or Apple.
  • Outcome — All, Errors only or Success.

Until you type a username the page says "Enter a username to compile that person's sync activity across the whole trust." If nobody in your schools has that username it says "No user with the username “x” exists in the schools you administer."

Step 3: Read the per-school health (Surface)

The heading says Found in N schools, with a badge showing the total errors across the trust in the window ("N errors in this window") or No errors in this window. Each school the person is found in gets a card showing:

  • the school, the person's name, their username, role and MIS ID;
  • their account status in that school: Active, Suspended, Locked or Deleted;
  • sync health: In sync, N errors, or No activity in the window. A school whose latest event is an error is outlined in red;
  • how many events there were and when the last one happened.

User log trace results showing per school health cards above a combined timeline

If the person's schools share one Google domain, a banner above the cards says Shared Google identity: the address is one Google account across those schools, and whether trust-level authority is on, only on for some of the schools, or off. See Shared Google domain trusts.

Step 4: Read the combined timeline

Below the cards, Activity timeline interleaves every event for the person across all their schools, newest first, with the school named on each row. That's how you see cross-school cause and effect, such as a change in one school followed by a failure in another. It shows 40 events a page.

Each row names what the event did, the platform and which user or group it acted on. Error rows are highlighted and carry a plain-English summary plus the real error message from the platform, which you can expand and copy. A repeated error shows how many times it happened (for example ×12). Error rows can also carry a badge:

  • Fixable — an admin can put it right, for example bad user data or a missing class owner.
  • Transient — it retries on its own, for example a rate limit or a temporary Google or Microsoft fault.
  • Escalate — needs Realsmart support or your Google or Microsoft domain administrator, for example a permissions or quota problem. Errors Realsmart can't classify default to this.

Step 5: Fix (or jump to the fix)

On each school's card:

  • Re-sync — needs Run syncs & provisioning. Asks you to confirm ("Re-queue {username} in {school} for sync?"), then queues that account for provisioning in that school only, and records it in that school's logs. The message "{username} re-queued for sync in {school}." confirms it was queued. It does not mean the account has reached the cloud yet; check back on the timeline.
  • Open user — switches you into that school and opens the person's edit page, where you can change their details. You leave MAT mode when you do this; use the school switcher to go back to MAT overview — all schools.

Re-sync won't send anything while that school's sync is paused for the summer. Instead of queuing, you'll see a message like "Cloud sync is paused until 1 September at {school}, so {username} has not been sent to Google Workspace. Their account syncs automatically when the pause ends." Nothing is lost. See Cloud sync is paused.


Troubleshooting

  • "I can't see User log trace in the sidebar" — you need MAT mode and the View logs & audit trail permission.
  • "A school is missing from the results" — the person may have a different username there. Trace that username too. The trace matches the exact username by design, to avoid merging two different people.
  • "I see two different people under one username" — they genuinely share a username across schools. Treat each school's record on its own and don't assume the timeline is one person.
  • "Re-sync didn't fix it" — open the user in that school to check their details, or read the error in the timeline: it carries the actual platform message to act on.
  • "Re-sync says cloud sync is paused" — that school is in its end-of-year freeze. See The provisioning window and the freeze.
  • "That user is not in your trust." (403) — the person you tried to act on isn't in a school you can reach.