> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Activity log

> Review and filter a tenant-wide record of administrator actions, sign-in outcomes, and lifecycle changes in the Iru Identity activity log.

The **activity log** is a running record of significant events in your tenant.
Find it under **Activity** in the Iru dashboard. Use it to answer
questions like *who changed this setting*, *did that sign-in succeed*, and *when
did this user's access change*, without leaving the dashboard.

<Note>
  The activity log is a read-only history. Events are recorded as they happen;
  you cannot edit or delete them. This makes the log a dependable source for
  reviews and investigations.
</Note>

## What gets recorded

Each entry captures a single event and the context around it. The log brings
together several kinds of events in one place:

<CardGroup cols={2}>
  <Card title="Administrator actions" icon="user-gear">
    Changes administrators make in the Iru dashboard: creating and editing users,
    groups, applications, policies, roles, and settings.
  </Card>

  <Card title="Sign-in outcomes" icon="right-to-bracket">
    The results of sign-in decisions, so you can see whether access was granted
    or denied and follow a user's recent activity.
  </Card>

  <Card title="Lifecycle changes" icon="arrows-rotate">
    Events as users and access move through their lifecycle (for example a
    user becoming active or suspended, or access being granted and removed.
  </Card>
</CardGroup>

## Reading the log

The activity list shows one row per event, sorted with the most recent first.
Each row summarizes the event across these columns:

| Column | What it tells you |
| - | - |
| **Occurred At** | When the event happened. |
| **Activity** | What happened, such as a sign-in, a user change, or an application change. |
| **Outcome** | The result of the event, such as **Succeeded**, **Denied by policy**, or **Not completed**. |
| **User** | The user the event is about. |
| **Target** | The object the event acted on. This can be an application, such as Salesforce or BambooHR, or a device. |
| **Actor** | Who or what performed the event. An actor can be an administrator, the user, or a scheduled process such as directory sync. |

Select any row to expand it. The expanded view shows the event's details,
including a **field-by-field list of what changed**, each affected field with
its previous value and its new value, so you can see exactly what an action
modified.

<Tip>
  Sort the list by any column header. Sorting by **Actor** or **User** groups
  events by who performed them, or by the user they are about.
</Tip>

## Filtering the log

Select **Filter** above the list, then choose one or more of these filters:

* **Occurred At:** limit the list to when the event happened.
* **Activity:** limit the list to one kind of event, such as **App sign-in**, **Iru sign-in**, **User created**, or **Authenticator created**.
* **Outcome:** separate successful events from events that were denied or not completed.
* **User:** focus on the user the event is about.
* **Actor:** focus on who or what performed the event.
* **Application:** show events for one application. The application appears in the **Target** column.

Combine filters to get the view you want. For example, set **Activity** to **App sign-in** and **Outcome** to **Denied by policy** to see denied application sign-ins.

<Note>
  Filters stay applied when you leave the activity log and come back.
</Note>

## Using the log for audit

Because every significant event is captured with its user, actor, activity,
outcome, and the exact fields that changed, the activity log doubles as
an audit trail. A few practices make it more useful:

<AccordionGroup>
  <Accordion title="Establish a regular review" icon="calendar-check">
    Filter to high-signal events, such as denied sign-ins or user and authenticator changes, and review them on a schedule. The filters remain when you return to the activity log.
  </Accordion>

  <Accordion title="Investigate a specific change" icon="magnifying-glass">
    Filter by **User** or **Application** to pull the history of one user or application, then expand individual events to see what changed and who changed it.
  </Accordion>

  <Accordion title="Trace a sign-in" icon="route">
    Filter by **Activity**, **User**, and **Outcome** to follow a user's recent sign-in results when you are troubleshooting access or responding to a report.
  </Accordion>
</AccordionGroup>

<Note>
  For how Iru protects your data and the controls behind your tenant, see
  [Security and privacy](/en/identity/security/security-and-privacy).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Administrators & roles" icon="user-shield" href="/en/identity/administration/administrators-and-roles">
    Control who can administer Iru Identity and what each administrator can do.
  </Card>

  <Card title="Authentication policies" icon="shield-halved" href="/en/identity/authentication/authentication-policies">
    See the policies that produce the sign-in outcomes recorded here.
  </Card>
</CardGroup>