Press CTRL+K to open search

Change tracking

  • 6 minute(s) read
Prev Next

Overview

The Change tracking tab in Explore shows the license, user, and Microsoft Entra ID group changes that Tenant Manager recorded from the Microsoft Entra ID audit log of a tenant. You see what changed, who made the change, when, and whether it succeeded. You can open a change record to see the values before and after, and the reason a change failed.

Business value

When a license disappears or a Microsoft Entra ID group changes, this tab shows what happened and who did it. You can tell a change made by a user from one made by an app, and you can review the changes that failed without opening the Microsoft 365 admin center.

Prerequisites

Before you use the tab, connect the tenant and let it finish its first sync. See Connect a Microsoft 365 tenant.

Required permissions

You need Read on Explore. The Owner, Contributor, and Reader roles include it. For details, see Roles and permissions in Tenant Manager.

Dependencies

Changes come from the Microsoft Entra ID audit log, which Tenant Manager stores during the sync.

  • AuditLog.Read.All: Change tracking needs this Microsoft Graph permission to read the audit log. Without it, the tab shows "No changes recorded yet" and its tiles show NA or 0. The sync issue shows on the warning icon next to Last synced, on the Tenants list, and as a not-syncing finding on Overview.
  • Microsoft Entra ID P1: Without P1, Microsoft returns about 7 days of audit history instead of 30. A tenant without P1 is not failing because of it.
  • History kept: each sync reads the audit log that Microsoft returns, up to 30 days, and adds only the changes that are new. Changes that are older than this window when the tenant first syncs are never recorded.

How it works

Select the tenant in the tree view, expand License management, select Explore, and then select the Change tracking tab. Explore is available for a tenant only.

Tiles and filters

Four tiles count the changes in the whole history.

Tile What it counts
License changes Licenses assigned to or removed from users or Microsoft Entra ID groups.
Lifecycle events Accounts added, invited, restored, deleted, enabled, or disabled.
Group changes Members or owners added to or removed from Microsoft Entra ID groups.
Failed Changes that didn't succeed.

A note beside the filters shows how many changes were recorded and since when. When nothing is stored, it says "No changes recorded yet".

The filter pills are All, License history, User lifecycle, Group changes, and Failed. Picking one clears the column filters and the sort and returns to the first page.

Columns

The grid has these columns. You can show or hide them in Column options.

Column What it shows
When When the change happened. This column is always shown.
Activity What happened.
Category The kind of change: License history, User lifecycle, Group membership, or Group ownership.
Target name The user, license, or Microsoft Entra ID group that changed.
Performed by The name of the user or app that made the change. Add Performer type in Column options to see whether it was a User or an App. It is blank when the audit log names neither.
Result Succeeded or Failed.
Modified properties The values before and after the change, as they were recorded.

The columns that are hidden by default are Tenant, Target type, Performer type, Performer app id, Operation (Add, Update, or Delete), and Result reason. Result reason says why a change failed, as Microsoft reported it.

Change record

Selecting a row opens the record of that change. It shows when the change happened, what happened, the target, the target type, who performed it, and the result. The What changed section shows the values before and after. The Why it failed section appears for a failed change. Use the arrows to move between the changes on the current page.

Steps

The steps below cover the common tasks on the Change tracking tab. You start in Explore for the tenant, with the Change tracking tab open.

Review recent changes

This procedure narrows the log to one kind of change.

  1. Select a filter pill, for example License history.
  2. To narrow further, use the filter menu of a column, such as Performed by.
  3. Select a row to open the change record.

Review failed changes

This procedure lists the changes that didn't succeed and shows why.

  1. Select the Failed filter pill, or select the Failed tile.
  2. Open a row, and read Why it failed in the change record.

Choose the columns

This procedure shows, hides, and reorders columns.

  1. Select Column options.
  2. Tick or clear the columns. A column with a grayed-out box is always shown.
  3. To change the order, drag a row.

Your choice is remembered in your browser.

Permission behavior

Every role with Read on Explore can see this tab. Nothing on the tab changes data, so no role needs Manage. Without Read on Explore, the page shows "You do not have access to this page".

Example scenario

A manager at Litware reports that a user lost a license on Monday. Elena Petrova, a module owner, opens Explore for the tenant Litware Canada and selects Change tracking. She picks License history and finds the change for that user.

The Performed by column shows the name of an app. She adds the Performer type column in Column options, and it shows App, not User. She opens the change record and reads What changed. She then knows which app removed the license and can check that app in Microsoft Entra ID.

Limitations

  • Explore is available for a tenant, not for a tenant group.
  • The tab has no Excel download.
  • You can't change or delete a recorded change.
  • The tab shows what the sync stored. It isn't live.
  • Change tracking records only license assignments and removals, account lifecycle events, and group member and owner changes. Other directory changes, such as a job title edit, aren't recorded.

Troubleshooting

  1. The tab shows "No changes recorded yet".
    Cause: no audit records are stored for the tenant yet, or the connection doesn't have the AuditLog.Read.All permission, so the audit log can't be read. In that case the tiles show NA or 0. The sync issue shows on the warning icon next to Last synced, on the Tenants list, and as a not-syncing finding on Overview.
    Fix: grant the permission with admin consent on the app registration, and then sync the tenant. If the permission is already granted, sync the tenant. After you grant the permission, only the last 30 days of changes (about 7 days without Microsoft Entra ID P1) can be recovered.

  2. Performed by is blank for a change.
    Cause: the audit log entry names neither a user nor an app.
    Fix: no action is needed. Use the Activity and Target name columns to identify the change.

  3. A message says that the changes could not be loaded.
    Cause: reading the stored changes failed.
    Fix: reload the page.

  4. A failed change has no clear reason.
    Cause: Result reason is hidden by default.
    Fix: add the Result reason column in Column options, or open the change record.

FAQs

  1. What kinds of changes does the tab show?
    License assignments and removals, user lifecycle events such as accounts added, invited, restored, deleted, enabled, or disabled, and Microsoft Entra ID group members and owners added or removed.

  2. Where can I see the changes for one person?
    Open the user's record in Explore users and select the Change history tab. It shows the latest 500 changes for that person.

  3. Can I download the changes?
    Not from this tab. The Excel download is available on the Users, Groups, and Licenses tabs.

  4. Do changes from approved tasks appear here?
    Yes, after a later sync. Performed by shows the app or person that Microsoft's audit log records for the change.

Related articles