Entering the Audit Log
You can enter Audit Log in the Backup portal by clicking your username at the right upper corner of the page and selecting Audit log from the drop-down menu.
Audit log is only visible for signed-in Admin users (not end-users)
Filtering the data
There are four filters that can be used either together or separately:
Actor = the signed-in user who has performed action(s) in the Backup portal
Event = action(s) taken, e.g. Emails were accessed or SharePoint restore was initiated. Multiple event types can be selected at a time.
Target user = user affected by the action, e.g. the user whose emails were accessed
Time range = time period when the action(s) were taken: last week / last month / last year / custom
Only relevant users / actions are displayed under the filters; e.g. list of users who have performed actions during the selected time range are listed under 'Actor' filter, and only actions that have taken place are listed under 'Event' filter. If, for example, a certain user is not visible under 'Actor' filter, the user has not taken any action in the Backup portal.
You can clear all filters by clicking the '' icon.
Displaying the results
All user actions taking place in Backup portal are listed in Audit log, apart from the following exceptions:
- Signed-in user accessing his/her own OneDrive or Mail folders
- Signed-in Admin user browsing shared organization data (SharePoint & Teams)
However, if user restores or downloads his/her own data, or Admin user restores or downloads shared organization data, these actions are visible in Audit log.
Data Restored / downloaded
When an email folder has been restored or downloaded, the folder name is displayed in Audit log's 'Details' column.
When single or selected emails have been restored or downloaded, email subject(s) are displayed.
OneDrive / SharePoint:
In case of file or folder restore, destination account and/or folder, SharePoint list / OneDrive folder name and file names and paths of all restored files are displayed in 'Details' column.
You can view the full list of restored files by clicking the '' icon, e.g:
Backup settings modified
When backup settings for user or organization services have been modified, both the old and the new settings are displayed in Audit log.
- To see the original settings prior to changing them, click the '' icon:
- Clicking the '' icon will show the new, changed settings: