Activity & security log

The activity & security log answers two questions: "who did what, and when?" and "did anything go wrong?" It's one org-wide, time-ordered feed that combines important changes in your organization (with the person, the action, and a before-and-after view) with sign-in & security events — logins, password resets, multi-factor prompts, lockouts, and device approvals — including the ones that failed.

One record of what happened — and what went wrong.

An org-wide, time-ordered feed of important changes (who changed what, with a before/after view) alongside sign-in and security events such as logins, password resets, lockouts, and device approvals — including failures. Use it to answer 'who did this, and when?' and 'did anything go wrong?'. Filter by group, date, or failures only; open an entry to see the details. Sign-in & security events are visible to administrators.

What you can do here

• Search by person (name or email), event type, or record kind
• Filter by group (e.g. Sign-in & security, Animals) or date
• Show only failures to spot lockouts and failed sign-ins
• See a person's full history from their user or volunteer page
• Open an entry to see the exact change or event detail

Find what happened

Use the filters to narrow the feed:

• Search — type a person's name or email, an event type ("password reset"), or a record kind ("animals") to match across those fields. (It searches the people and labels on each entry, not the values buried inside a change's before/after detail.)
• Group — focus on one kind of activity, such as Sign-in & security, Animals, or Activities & events.
• From / To — limit to a date range (up to 90 days).
• Failures only — show just the things that didn't succeed (failed sign-ins, lockouts, denied devices) so problems stand out.

To see everything for one person, open their profile from Users (or Volunteers) and choose View full activity log — that lands here pre-filtered to that person.

Click any entry's View to see the full detail — for a change, the old and new values; for a security event, the surrounding context.

Who can see security events

The sign-in & security half of the feed contains sensitive information (such as failed sign-ins and IP addresses), so it's shown to administrators only. Other roles with audit access still see the record-change half; the security events are simply hidden from their view.

Fields explained

No field-level help for this page.

TIP

The log is read-only — entries can't be edited or deleted. That's what makes it trustworthy.