> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ctrlconnect.nl/llms.txt
> Use this file to discover all available pages before exploring further.

# Search the audit log

> Find who did what, when, and to which object across Microsoft 365 and CtrlConnect, with filters, bookmarks, event details, and CSV or JSON export.

The audit log records every action in your tenant, whether a person, CtrlConnect, or Microsoft 365 made it. Use it to answer who did what, when, to which object, and with what result. Open it from **Audit log** in the sidebar.

## Filter events

* **Source**: choose **All sources**, **Tenant logs** (Microsoft 365 and Entra admin changes and sign-ins), or **Platform logs** (changes made in CtrlConnect, such as templates, roles, and access).
* **Search** across the event details, the actor, and the target.
* **Severity**: show only events of a given severity, such as Critical or High.
* **Category**: pick one or more categories, such as sign-ins, role changes, licenses, groups, files, or sharing.
* **Date range**: pick start and end dates.

## Bookmark events

Star an event to bookmark it, then turn on **Bookmarks only** to see just those events. Bookmarks are saved in your browser.

## View an event

Click an event to open the detail panel next to the list. It has four tabs:

| Tab | What it shows |
| - | - |
| **Overview** | Summary, severity, source, actor, target, result, time, and correlation ID. |
| **Activity** | Related events for the same object, in order. |
| **Raw event** | The original event data exactly as received. |
| **Comments** | Internal notes for your team. You can @mention colleagues. |

## People and automated jobs

Each event shows whether a person or an automated CtrlConnect job made the change. The two look different and can be filtered separately. Background jobs are never recorded as a human admin, so you can always tell which changes a person made.

## Export

Export the current view to CSV or JSON. The export uses your filters and sort order. To see an event's full original data, open its **Raw event** tab.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.