Audit log and integration activity

Admin › Account › Logs answers two questions: who did this, and what did our connections do. It has two tabs, Audit log and Integrations. You need View the audit log to open it.

schoolOS staff choose an Account at the top of the page. Both tabs then show that account's activity. Changing the account clears the old results and loads the newly selected account.

Audit log#

Every change in your account, like settings, people, tickets, assets and tasks, plus every sign-in and failed sign-in attempt. Newest first.

Search and filters#

• Search what changed, who, or where. Matches the person's name or email, the kind of change, and the old and new values.
• Filter › Area. One of Settings, People & roles, Tickets, Assets, Tasks & projects, Knowledge, Account, Imports & exports (imports started and finished, exports and downloads) or Sign-ins. Without it, you see everything.
• Filter › People. One or more people.
• Show system changes. Off to start: the log shows what people did. Turn it on to also see what automations, syncs, scheduled jobs and public forms changed, and anything recorded with no one behind it (shown as System). Those entries read Automated (…) or the automation's own name under User.

The log loads 200 entries at a time. Search and the people filter only look through what's loaded, so if you can't find something, select Load more at the bottom and try again. Area asks for fresh entries from the whole log. Refresh reloads the newest entries. If nothing matches, Clear search and filters starts again.

Columns#

• Time. When it happened, in your district's date format and your own computer's time zone, like "09/05/2026 · 1:29 PM". Dates and times inside a change (a new due date) read the same way; a date with no time is never moved to another day.
• User. Who did it, with their email. When a schoolOS support person made the change while viewing your account as someone, a line under the name says so, like "by Jane Smith, viewing as them".
• IP address. Where it came from. Sign-ins also show the country's flag.
• Item. What was changed, with its name: Asset: MacBook Air, Ticket: Printer jammed, Role: Technician. A status, location, owner or assignee in the activity shows its name too, never an id.
• Activity type. Such as Created, Updated, Deleted, Signed in, Sign-in failed or Signed out.
• Activity. Each field that changed, from its old value to its new one. Onboarding progress appears as a short summary or named setup-task changes, without its stored data format. Long lists fold after three lines; select the link to see the rest. For other long values, select View details to see their full before and after values.

Select a column's edge and drag it to make it wider or narrower. The log loads newest first, a batch at a time: once Load more is gone and every entry is here, select a column's name to sort by it.

Undo a change#

Some changes have Undo in their row's … menu. It asks first, then puts back the values from before the change.

Today, undo works for edits to repair types, asset types and funding sources. Other changes don't have it. To reverse one of those, change it back by hand, using the old values shown in Activity.

Undo needs Undo audit log changes, a separate permission from viewing the log, so you can let people read the log without letting them reverse changes. See Roles and permissions.

Who should get which:

| Give | What they can do | Choose it for | | --- | --- | --- | | View the audit log (Admin console at View) | Read every change and sign-in. | Anyone who answers "who changed this?": a technology director, an asset manager, a security or compliance lead. | | Undo audit log changes (Admin console at Full) | Also reverse supported changes. | The few people who already own those settings, usually your Super Admins. |

For example, someone renames the asset type "Chromebook" to "Laptop" by mistake, and every Chromebook now shows as a Laptop. Find the change with Area set to Settings, check the old value in Activity, then select Undo in its … menu and Undo change. The asset type goes back to "Chromebook", and the undo is logged.

Integrations#

What your connected systems have been doing: syncs, errors and warnings, across every integration at once. Use it to answer "is anything broken?" without opening each integration.

Above the list, Last 24 hours counts Success, Warning, Error and Info. Select one to show only that kind. Select it again to show everything.

Search and filters:

• Search activity...
• Filter › Integration. One integration, like Jamf Pro or Google Drive.
• Filter › Status. One status.
• Refresh reloads the list. If nothing matches, Clear search and filters starts again.

Each row shows its Status, What happened (a one-line summary and the event), the Integration, who started it (Automatic when no person did), When and how long it Took. Select a row, or Details in its … menu, to see everything recorded about it.

Load more at the bottom shows older activity.

If the list is empty, nothing has synced yet. Set up a connection on Admin › Account › Integrations.