Organisation Audit Log
Search, filter, and export security events across your organisation — login activity, SSO, SCIM provisioning, policy changes, and SIEM exports.
What is recorded
Events are written to an append-only audit table (separate from workspace delivery audit). Typical entity types include security, orgSecurity, and orgSso. Examples:
- Login success and failure, SSO login, logout
- MFA challenge and enrolment
- SCIM user provision and de-provision
- Organisation security policy changes
- SIEM export actions
Exporting
Export CSV / JSON — Download filtered results (up to 10,000 rows) for spreadsheets or archival.
Export for SIEM — Writes a JSON bundle to encrypted storage and opens a presigned download URL valid for 24 hours. Use for Splunk, Microsoft Sentinel, or similar tooling.
Retention
Retention follows the Audit log retention (days) setting on Organisation Security (default 365). Workspace-level overrides may apply to workspace-scoped audit only.
Procurement and trust materials: Enterprise trust centre · Vendor pack