Search and filter the Logs page

In the sidebar, under Admin, open Logs. In MAT overview it covers every school you administer, with an extra School column. Under Entra sync and Active Directory there's also a Logs link that opens the page already filtered to that platform.

Two view modes sit next to the search box and the Filters button, so switching between them is one click — no need to open Filters:

• Grouped (default) — errors folded into one row per root cause, with the affected users, the badge and the Fix / Retry / Ignore actions.
• Table — one row per individual log entry, with the columns When, Source, Action, Affected and Outcome (plus School in MAT overview). Use this when you want the raw feed — to scan chronologically, to check a specific run, or to read successes and skips alongside failures. The Affected column shows who the row acted on — the user and, for membership changes, the group or classroom too. Where a failure kept repeating, the row shows its most recent time plus a ×N count, so a persistent problem never looks like a one-off. Admin edits to a user list each changed field with its new value, except credentials: a password, PIN, 2FA secret or QR code change is recorded as changed, never with the value. The table moves one page at a time with Previous and Next.

Switching mode moves the Outcome filter with it, because the two answer different questions: Table shows all outcomes (the whole story, successes and skips included), and Grouped goes back to Errors (grouping by cause only applies to failures). Pick an outcome by hand afterwards and it stays put. The Active Directory log only records successful imports, so it has no Grouped view.

The view you pick is part of the page address, so you can bookmark or share a link straight to the table view.

Select Filters (or press f) to narrow results. Applied filters show as chips above the list, with Clear all:

• Source: which part of the system wrote the row — Google Workspace, MIS / Wonde, Fetch, Apple School Manager, Microsoft Entra or Active Directory. Only sources that have activity, or that your school has switched on, are offered.
• Outcome: All outcomes, Errors (the default), Success or Skipped (unchanged) — skips are hidden by default. Skipped rows are changes the sync deliberately didn't make: most mean nothing had changed, but a few say why something was held back — Membership changes withheld (an address that's an alias on someone else's Google account — see Rename a user), Role check skipped (Google couldn't say what someone's group role is; checked again the next night, nothing to do), or Adds skipped … group address(es) are held by another account (see Group addresses in use).
• Time window: Last 24 hours, Last 7 days (the default) or Last 30 days; leave it empty for all time.
• Action: Add to classroom, Remove from classroom, Create classroom, Update classroom, Archive classroom, Create account, Update account, Delete account, Add to group, Remove from group, Move user (organisation unit) or Active Directory import.
• User (a username — a name nobody has shows no rows rather than being ignored), free-text Search (the box on the bar), Sort (Newest first or Oldest first) and Ignored errors (Show ignored).

To investigate a specific user, type their username into the User filter.

If you arrived by clicking a bar on a Sync activity chart, a chip reads Showing … only with a Clear button — that's the one day you clicked.