Search the audit log - CtrlConnect

The audit log records every action in your tenant, whether a person, CtrlConnect, or Microsoft 365 made it. Use it to answer who did what, when, to which object, and with what result. Open it from Audit log in the sidebar.

Filter events

Source: choose All sources, Tenant logs (Microsoft 365 and Entra admin changes and sign-ins), or Platform logs (changes made in CtrlConnect, such as templates, roles, and access).
Search across the event details, the actor, and the target.
Severity: show only events of a given severity, such as Critical or High.
Category: pick one or more categories, such as sign-ins, role changes, licenses, groups, files, or sharing.
Date range: pick start and end dates.

Bookmark events

Star an event to bookmark it, then turn on Bookmarks only to see just those events. Bookmarks are saved in your browser.

View an event

Click an event to open the detail panel next to the list. It has four tabs:

Tab	What it shows
Overview	Summary, severity, source, actor, target, result, time, and correlation ID.
Activity	Related events for the same object, in order.
Raw event	The original event data exactly as received.
Comments	Internal notes for your team. You can @mention colleagues.

People and automated jobs

Each event shows whether a person or an automated CtrlConnect job made the change. The two look different and can be filtered separately. Background jobs are never recorded as a human admin, so you can always tell which changes a person made.

Export

Export the current view to CSV or JSON. The export uses your filters and sort order. To see an event’s full original data, open its Raw event tab.