Administrative session and audit investigation

Prerequisites and authority

Use an individual staff account with the action permission and required organization module/license. Viewing a menu does not establish permission to mutate records.

Reconstruct an administrative change

Use Administration → Audit Logs, Login Sessions and System Activity together. Audit records explain administrative actions; login sessions identify access; system activity and operation records help explain automated work.

1. Define the incident time window and timezone.
2. Filter by actor, target or action where supported.
3. Compare the request, result and relevant prior/new state.
4. Identify the administrator session and any related operation.
5. Record the chronology and explain discrepancies.

An action marked successful may still trigger asynchronous work whose later result must be checked. Conversely, a failed notification can follow a successful entitlement change. Trace the separate outcomes.

If a login looks unfamiliar, compare session time/source and the user's actual activity before revoking it. Use supported session controls and verify the revocation took effect. Do not delete audit evidence during cleanup.

Export only the evidence required for escalation. Redact authentication material, customer contact details and unrelated records. Preserve the original privately when authorized so redaction does not erase necessary evidence.

After resolution, record who changed what, when, why and how the result was tested. Use the incident template for investigations that span multiple services.

Related guides

Related guides: Staff accounts, roles and permissions, System operations and task controls, Roles and permission matrix.