Cloud · Reference · 02
Audit log events
Every event the audit log records, grouped by what it's about.
The audit log records an event for every change to your organization. Each one names who made it: a person, or System for what Cloud does on its own, such as a domain's daily check. Search for an event by its words, or by the event name in the second column, which is also what the CSV export calls it.
Organization
| What the log says | Event |
|---|---|
| Created the organization | org.created |
| Renamed the organization | org.renamed |
| Required single sign-on, or set the sign-in methods | org.sign_in_methods_changed |
| Turned new-sign-in emails on or off for members | org.new_device_emails_changed |
| Scheduled the organization for deletion | org.deletion_scheduled |
| Cancelled the organization's deletion | org.deletion_cancelled |
Members
| What the log says | Event |
|---|---|
| Invited someone, with their role | member.invited |
| Sent an invitation again | member.invitation_resent |
| Revoked an invitation | member.invitation_revoked |
| Joined as an admin or owner (an invited role applied) | member.invite_role_applied |
| Joined through a verified domain | member.joined_by_domain |
| Moved someone to another organization that claimed their domain | member.claimed_away |
| Changed someone's role | member.role_changed |
| Removed someone | member.removed |
| Disabled, or turned back on, an account | member.disabled, member.enabled |
| Deleted an account | member.deleted |
| Signed someone out everywhere | member.signed_out |
Domains
| What the log says | Event |
|---|---|
| Added a domain | domain.added |
| Verified a domain | domain.verified |
| Removed a domain | domain.removed |
| Couldn't find the TXT record in the daily check | domain.recheck_failed |
| Found the TXT record again | domain.recheck_passed |
| Stopped treating a domain as verified after 7 days without its record | domain.unverified |
| Added people who use a domain | domain.people_added |
| Claimed a domain | domain.claimed |
| Stopped checking a new domain after 7 days (shown by its event name for now) | domain.verification_expired |
Single sign-on
| What the log says | Event |
|---|---|
| Set up a connection | sso.created |
| Changed a connection's settings (shown by its event name for now) | sso.updated |
| Ran a test sign-in | sso.tested |
| Activated a connection | sso.activated |
| Required single sign-on for a domain | sso.enforced |
| Made single sign-on optional for a domain | sso.unenforced |
| Deleted a connection | sso.deleted |
| Noticed a signing certificate expiring soon | sso.cert_expiring |
| Couldn't read a connection's metadata | sso.health_check_failed |
Confirming it's you
| What the log says | Event |
|---|---|
| Confirmed it's them by signing in again | auth.confirmed |
What's next
- Review the audit log: search, filter and export.
- Roles and permissions: who can make each change.