---
title: "Audit log — Clock Clerk user guide"
description: "The Audit log tab under Settings in Clock Clerk: who signed in, who changed whose role or access, how the organization was set up and what Clock Clerk support did, kept for a year and exported as CSV, for administrators on every plan."
url: "https://clockclerk.com/guide/screens/admin-audit"
---

Screens

# Audit log

A record of who signed in to your organization, who changed whose role or access, who changed how the organization is set up, and what Clock Clerk support did to it. An administrator can read it, filter it and export it. Nobody can change an entry or delete one early, not even an administrator or the app itself; each is deleted when it is a year old.

## Who sees it

Administrators only, on every plan: it is **Audit log** under **Settings** in the menu, at [/admin/audit](https://app.clockclerk.com/admin/audit). Finance and managers don't have it, because the log names everybody's sign-ins, roles and access, and anyone else who opens the address is told *You don't have access to this area*. It is not a paid extra: every organization keeps one, from the day it is created.

Under the heading, one line says what the page is: *Who did what in your organization, and when.* The **(i)** icon at its end opens the rest: what is recorded, that nobody can change or delete an entry, and what Export saves. In an organization that signs in with Microsoft Entra ID, a band beneath it says *Sign-ins with Microsoft Entra ID are recorded in Entra, not here*, and its own **(i)** says where to find them (see What is not recorded). An info icon opens on a click, a tap, or Enter, and closes on Esc, a click elsewhere, or a second click.

## The events

The table lists the events newest first. Each row says:

- When it happened and where from: the date, and beneath it the time and the IP address the request came from. Something Clock Clerk does on a schedule has no address, so only the time shows.
- Who did it: a person in your organization, your identity provider over SCIM (shown by the name of its token on [Provisioning](https://clockclerk.com/guide/screens/admin-provisioning.md)), Clock Clerk itself, for example when somebody is added the first time they sign in with Microsoft, or **Clock Clerk support**, for anything one of Clock Clerk's operators did to your organization.
- What happened, for example a sign-in, a role changed or a feature turned off, and beneath it, where there is something to say, what it affected: how somebody signed in, the organization's sign-in method before and after, the role before and after, the feature turned off, the client or project the access is on, or the integration changed.
- Whom it was done to, where that is somebody other than who did it: the person whose role changed, or the SCIM token issued or revoked. Sign-ins have nobody here. The **To whom** column only shows while at least one of the events listed has somebody there, and then on every row, with a dash where an event has nobody; otherwise what happened takes its width.

Clicking a row, or its **Details**, opens it: everything the event recorded, with each value before and after, and anything only that event has to say, such as why a sign-in was refused. The browser the request came from is shown there too. On a narrow screen, whom it was done to, with their email address, moves under what happened.

People are named as they were at the time. Someone who has since been renamed or removed from the organization still shows under the name and address they had then, so removing a person never removes what they did.

## Finding an event

Above the table, four filters narrow what it shows. They combine, and the table and the export follow them:

- A date range, from and to.
- Who did it: one person.
- Whom it was done to: one person.
- A category: **Sign-in**, **Access**, **Organization** or **Clock Clerk support**. The first three match the sections below; **Clock Clerk support** shows everything an operator did, whatever it was.

The table shows the most recent events first, a page at a time, and the end of the filters' row says how many are listed, with a *+* while there are older ones. **Show older entries** at the foot adds the next page back, until there is nothing older to show.

## Exporting the log

**Export** downloads the events the filters match as a CSV file, which opens in Excel, Google Sheets or any spreadsheet. It holds every matching event, not just the pages you have loaded, one row per event, with its details. Times in the file are in UTC, so they read the same wherever it is opened. To keep a copy for longer than Clock Clerk keeps the log, or to hand it to an auditor, export it with the date range you need.

## What is recorded: signing in

For organizations that sign in with a password, Okta or another OpenID Connect provider:

- A successful sign-in, and how: with a password, with an unlock, set-password or reset link, or through Okta or your OpenID Connect provider.
- A wrong password for somebody in your organization, and the wrong password that locked their account, with when the lock lifts.
- A sign-in your identity provider allowed but Clock Clerk refused, for a person your organization knows, with the reason: for example that they were never invited, have left, or tried another organization's sign-in.
- Signing out, and, for organizations that sign in with a password, **Sign out everywhere**.
- A first password chosen from an invitation, a password reset asked for and completed, and a password changed by its owner.
- Two-step sign-in turned on or off, recovery codes replaced, a passkey added or removed, and, at sign-in, a code or passkey accepted, a recovery code used and a wrong code.

## What is recorded: people and access

Every change to who is in the organization and what they may do, whether it was made on [People](https://clockclerk.com/guide/screens/admin-people.md) or by your identity provider over SCIM. Each event names the person changed and says what it was before and after. Saving without changing anything records nothing.

- A person added, including someone added by your identity provider or the first time they signed in with Microsoft, and a person removed before they ever signed in.
- A role changed, Finance included.
- A person's access ended by a **Left** date, or resumed.
- Anything else changed about a person: their name, email address, job title, start or end date, paid holidays, or their permissions to reopen a week, countersign or create tasks.
- An invitation sent or sent again, and an invitation link copied.
- Client access and project access granted, changed or taken away.
- A SCIM token created or revoked on [Provisioning](https://clockclerk.com/guide/screens/admin-provisioning.md).

## What is recorded: the organization and Clock Clerk support

How the organization is set up, with the value before and after:

- The organization created, and how: on sign-up, by an administrator's consent in Microsoft Entra ID, or by Clock Clerk.
- On [Organization](https://clockclerk.com/guide/screens/admin-organization.md): its name, language, the automated email and the guests' news box; the sign-in method switched on or back; a Microsoft directory connected; the accent color and logo; and its data downloaded with **Download your data**.
- A feature turned on or off on [Features](https://clockclerk.com/guide/screens/admin-features.md) or in the setup wizard.
- An integration added, changed, signed in to again or deleted on [Integrations](https://clockclerk.com/guide/screens/admin-integrations.md), and what the [ERP export](https://clockclerk.com/guide/screens/admin-erp.md) sends and from when.
- The plan changed, the trial extended, the subscription canceled or kept, and a new payment card, shown by its brand and last four digits.

And everything Clock Clerk support does to your organization, as **Clock Clerk support**: creating it and naming its first administrator, changing its workspace address or sign-in settings, changing its plan or trial, lifting a lapsed subscription's lock, suspending or reopening it, sending invitations, resetting an administrator's two-step sign-in, and downloading a copy of everything it holds.

**No password, secret, key or token is ever recorded.** A changed client secret or integration key is recorded only as changed, and a new logo by a fingerprint of the image.

## What is not recorded

The log is a record of who gets in and how the organization is set up, not a history of every change. Left out on purpose:

- **Microsoft Entra ID sign-ins.** People who sign in with Microsoft do it with Microsoft, in the browser, and Clock Clerk never sees the sign-in itself. Those sign-ins are in your own Entra sign-in logs, in the Microsoft Entra admin center under `Monitoring & health`, `Sign-in logs`. In an organization that signs in with Microsoft Entra ID, the Audit log page says so itself, in a band under its heading.
- **Keeping a session alive.** A signed-in browser renews its session every few minutes; its sign-in is already recorded, and every renewal would bury everything else.
- **A wrong password for an address nobody in your organization has**, or a sign-in refused for somebody your organization has never heard of. It belongs to no organization, and recording it would say whether the address exists. Nor is the right password turned away while an account is locked, because the lock is already recorded.
- **Timesheets, expenses, invoices and the catalog** of clients, projects and tasks. Those keep their own history: a week shows who submitted, sent back and approved it, and invoices keep their numbers and payments.
- **Who is on a project's team.** Managers change it daily on the project's page; the client or project access that makes somebody a project's manager is recorded.
- **Guests** invited into a thread shared with a client, who reach that thread and nothing else.
- **How records are kept**: the default activity, the receipt threshold and invoice settings.
- **Steps that change nothing yet**, such as asking support for a sign-in method, starting a test sign-in or testing a connection. What each leads to is recorded when it happens.
- **The live demo**, which everybody shares and which is reset on a schedule.

## How long it is kept

Events are kept for a year, then deleted, a little at a time, every hour. A year is long enough to answer who did something and when about anything you are still asking about, and no longer, because every sign-in names a person and the network address they came from. Export what you need to keep for longer. If your organization is removed, its audit log goes with it. The [privacy notice](https://clockclerk.com/privacy.md) says the same.

## Buttons and when they appear

| Button | What it does | When you have it |
| --- | --- | --- |
| Details | Opens the row to show the event's details and the browser it came from; clicking anywhere else on the row does the same. | On every row. |
| (i) | Shows more about the line it ends: what the log records and keeps, or where to find Microsoft Entra ID sign-ins. Esc or a click elsewhere closes it. | At the end of the line under the heading, and of the Entra band in an organization that signs in with Microsoft Entra ID. |
| Show older entries | Adds the next page of older events to the table. | While there are older events matching the filters. |
| Clear filters | Puts every filter back to all. | While a filter is set. |
| Export | Downloads every event the filters match as a CSV file, with times in UTC. | Unless the To date is before the From date. |

There is no button to edit or delete an event, and the app itself is not allowed to: the database refuses it. Reading and exporting the log are checked again on every request, so only an administrator can do either (see [Roles](https://clockclerk.com/guide/roles.md)).