Required access: platform administration. Audit exports may contain account and workspace information; store and share them only with people authorized to review it.

Find recorded actions

1. Choose Audit in the Operator sidebar.
2. Start with a time window using From (UTC) and To (UTC). Enter UTC times, not your local timezone.
3. Add filters as needed: Actor user ID, Resource type, Resource ID, Action or Correlation ID.
4. Select Apply filters.
5. Review the matching-row count and results. Use Clear filters to start again.

The example below filters Action to tenant.updated, showing a workspace update.

Use complete identifiers in the filters. Table cells shorten some identifiers to keep rows readable. The actor can be (system) for an automated action.

Open this screenshot at full size.

Export matching events

1. Apply the desired filters and check the results.
2. Select Export CSV (max 10,000).
3. Open the downloaded CSV in your preferred viewer.

The export uses the active filters and is capped at 10,000 rows. Narrow the time range if an investigation needs a smaller, complete slice. The page’s Previous/Next controls browse results without changing the filter values.

No matching rows

Remove a filter or widen the time range. Check full identifiers, action spelling and UTC conversion. An empty filtered result is not evidence that no activity occurred anywhere on the platform.