The Administration log records who signed in when and who changed members, roles, the account and organisations. It does not show any ISMS content such as risks or policies. This guide explains what the log contains, how you filter and export it, and how it differs from the full change log. It is aimed at Tenant Admins.

Before you start

  • Tenant Admins see the administration log under Administration › Administration log.
  • Entries cannot be changed or deleted, not even by Tenant Admins.
  • The administration log does not show changes to ISMS content. These are in the full change log under ISMS management › Change log (functional roles “Internal audit & review (read only)” and ISMS manager).

What the log records

Each entry states the time, event, affected person or item and the person who acted. The entries belong to one of these areas:

  • Sign-ins: successful sign-ins, failed sign-ins (wrong password), sign-ins blocked after too many failed attempts and rejected sign-ins when access is blocked.
  • Members and access: members added or removed, access deactivated or reactivated, password reset, sign-in unlocked, Tenant Admin role assigned or revoked, and changes from Microsoft Entra ID.
  • Functional roles and permissions: functional roles created or deleted, permissions added or removed, and segregation of duties exceptions.
  • Account and organisations: organisations created, archived, reactivated or scheduled for deletion, changes to the account such as the deletion period, data exports, domains for single sign-on and API keys.
  • Support access: granting and revoking of support access, start and end of each support session and the pages that support viewed during it.

How to proceed

  1. Open Administration › Administration log.
  2. Choose the Period: Last 7 days, Last 30 days (default), Last 90 days, Last year or All.
  3. Under Area, narrow it down to one area or leave All areas selected.
  4. If your account has several organisations, choose one under Organisation or leave All organisations selected. The Organisation column then shows which organisation an entry belongs to.
  5. With CSV or JSON, you download the filtered entries, for example for an audit or the annual access review.

What happens next

  • New entries appear immediately.
  • Varmo deletes sign-ins after the retention period you define under Administration › Account & contacts in the Retention card. The change log is kept as long as the organisation exists.
  • If an organisation is permanently deleted, its logs are also deleted. See Managing organisations and the account.

Frequently asked questions

How does the administration log differ from the change log?

The administration log only shows administration: sign-ins, members, roles, account, organisations and support access. The full change log under ISMS management › Change log also records every change to ISMS content. It can be seen by people with the “Audit log: View” permission; by default, these are the functional roles “Internal audit & review (read only)” and ISMS manager.

Why can I no longer see a sign-in?

Sign-ins are deleted after the defined retention period. Also check the selected period; with All, you see all entries that still exist.

Can I correct or delete an entry?

No. Entries cannot be changed or deleted, so that the log is suitable as evidence.

What did support view in my organisation?

Choose the Support access area. Every session is listed there with the pages viewed. How you grant and revoke access is explained in Contacting support and granting support access.