Audit logs overview · BreezeAuth Docs

The audit logs are your organization’s history: a chronological record of what happened, who did it, from where and when. Every feature of BreezeAuth writes to them, from a user being added to a group to a security setting being changed or a sign-in failing.

Use them to answer questions such as “who gave this person the Administrator role?”, “when was this application’s configuration changed?” or “has anyone been failing to sign in to this account?”. They are also the evidence auditors and compliance teams ask for.

Where to find them

In the sidebar, select Audit Logs to see the full history, with filters.
On the Dashboard, the Recent activity card shows the latest five events. Select View more to open the audit logs.

Only the Owner, Administrator and Auditor roles can see the audit logs. For other roles, the Audit Logs item doesn’t appear in the sidebar. The audit logs are read-only: nobody, not even an Owner, can edit or delete an entry.

What is recorded

Area	Examples
Users	Users created, updated or deleted; invitations sent, accepted or declined; sessions ended.
Accounts	Managed users signing in and out, failing to sign in, changing their password, setting up MFA or passkeys.
Groups	Groups created, updated or deleted; members added or removed.
Applications	Applications and their attribute mappings, signing certificates and network restrictions; access assigned or removed; SAML sign-ins.
Service users	Service users and credentials created, updated or deleted; credentials used to obtain access tokens.
Organization	Settings changed, including security settings and the application lock; incident-response actions.
Domains, network zones and webhooks	Created, updated, deleted; domain verification started and completed.

The event catalog lists every event and when it is recorded.

Note: events about a person’s own account, such as sign-ins, password changes and MFA, are recorded only for managed users, in the organization that manages them. A guest’s account belongs to the guest, so those events don’t appear in your audit logs. What you do to guests in your organization, such as changing their role or removing them, is recorded as usual.

Read an entry

The list shows the most recent events first. Each row has five columns:

Column	What it shows
Event	What happened, such as Group created or User signed in. A document icon next to it means the entry includes the changes made.
Entity / Resource	What the event is about: an Organization user, a Group, an Application, a Network zone or a User account. Names are links to the item’s page.
Actor	Who did it: a person or a service user, with their name and e-mail, or System for actions BreezeAuth performs on its own.
IP address	The address the action came from. Empty for actions performed by the system.
Date	When it happened, in your browser’s time zone.

See what changed

When an event changed something, such as Organization user updated or Organization updated, hover over the document icon next to the event. A tooltip shows the values Before and After the change, one field per line. For example, giving someone the Administrator role shows adminRole: null before and adminRole: ADMIN after.

Fields are shown with their technical names, such as status, adminRole or mfaEnforced, because they are the same in every language.

The actor

Actor	When
A person	An administrator acted in the admin console, or a person acted on their own account, such as signing in or accepting an invitation.
A service user	An integration acted through the BreezeAuth API, for example a SCIM provisioner creating users.
System	BreezeAuth acted on its own, for example when it completes a domain verification in the background.

The entity and the actor are different

The Entity / Resource is what the event is about; the Actor is who did it. When an administrator deactivates a colleague, the colleague is the entity and the administrator is the actor. When someone signs in, they are both.

Next steps

Filter and investigate to find specific events.
Browse the event catalog.