Activity log and CSV export
Filter and search the audit trail of privileged actions, and export it.
Who can do thisTenant Admin
The WorkspaceActivity page is the audit trail of privileged actions in your workspace: "Append-only audit of privileged workspace actions. Filter, search across full history, and export to CSV." Append-only means entries are added and never edited or deleted, so you can rely on it to see who changed what, and when.
The Overview shows the latest entries in its Recent activity card. View all opens this page.
What the table shows
| Column | Content |
|---|---|
| When | Date and time of the action. |
| Who | The person who did it, for example Signe Mortensen. |
| Event | The kind of event. |
| Activity | What happened, with details. |
The list shows 50 entries at a time, with a count such as "Showing 1 to 50 of 1,234". Use Previous and Next to page through it.
Find an entry
- Pick an Event type: All events, API keys, App access, Billing, Branding, Groups, Platform-role changes, Profile, Data residency, Roles, SSO, Subscriptions or Users.
- Pick an Actor to see one person's actions, or leave All actors.
- Narrow the period with From date and To date.
- Type in Search ("Search by event, person, or details…"). The search covers the full history, not only the page you are looking at.
Clear resets all filters. When nothing matches, the page says No matching activity and suggests adjusting or clearing the filters.
To answer "who gave Kasper Vinther access to Helpdesk?", choose the event type App access and search for Kasper. To see who made someone a Tenant Admin, use Platform-role changes.
Export to CSV
Click Export CSV (it shows Exporting… while it works). Your browser downloads a file named after today's date, for example audit-2026-10-19.csv, which you can open in a spreadsheet. The export uses the filters you have set, so set them first if you only want part of the log. The button is disabled when nothing matches.
Paging stops after 5,000 entries. A larger result shows the line "Showing the first 5,000 - refine the filters or export for the full set." Use the export when you need every row.
What is and is not in the log
The log records privileged workspace actions, such as inviting and removing people, changing platform roles and app access, groups, subscriptions, billing details, branding, single sign-on settings, API keys and data residency. It is not a list of everyone's sign-ins. For one person's sign-ins, open them in Users & access and look at the Activity tab, which lists Recent sign-ins.