Overview
User activities in Tenant Manager records every management action that people and automations take in the module. You can view the log to see who changed what and when, from the module as a whole down to a single tenant. The log covers changes to tenant groups, tenants, license requests, approvals, automations, escalation policies, reports, users, and alerts.
Business value
A complete audit trail supports governance and simplifies investigation. When a client secret is updated, a license task is approved, or an alert is switched off, you can see who did it and when, without asking around. Entries made by automations are marked, so you can tell them apart from changes made by people.
How it works
Tenant Manager writes a log entry whenever someone changes something. Each entry shows what was done, to what, by whom, and when. Entries are listed newest first, 50 to a page. Entries are kept for 30 days, as in the other Turbo360 modules.
The log is available at two scopes. At module level, User activities is available from the gear icon in the Tenant Manager sidebar header, under User activities, and the page shows the activity for the tenant groups and tenants you have access to. At tenant group or tenant level, it is available from the context menu ( ⋮ ) of a tenant group or tenant in the tree view, under Security > User activities. This log opens over the workspace and covers that tenant group or tenant and everything beneath it, so a tenant group's history includes the changes made to its tenants.
You see only the entries for the tenant groups and tenants you can access, so a user with access to one tenant sees only that tenant's entries. Entries that are not tied to a tenant group or tenant, such as escalation policy and user management changes, are shown only to people with access to the whole module.
Anyone who has access to Tenant Manager can open the module's User activities page. Tenant Manager entries also appear in the account-wide User activities under Settings for users who have access to Tenant Manager.
What an entry shows
Each entry reads like "Updated - Tenant - Contoso" or "Disabled - Alert - Client secret expiry". It also shows the activity type, who made the change, and the time. Select an entry to see its details. The details repeat the summary and add what changed. For a report, they show its frequency, format, recipients, and whether it is on. For a user role, they show the permissions it grants. For a deleted tenant group, they show how many nested tenant groups and tenants were deleted with it. For changes where Tenant Manager recorded the earlier state, the Changes view compares the old and new values. Each time you rename a license or reset its name, Tenant Manager logs it as "Renamed - License - {Microsoft name}" or "Reset - License - {Microsoft name}". The details show the License, the Microsoft name, the Friendly name, and the Path, and the Changes view shows the old and new name. Excluding a user from removals and including the user again are logged as "Excluded - Removals - {name}" and "Included - Removals - {name}". The details show the user and, for an exclusion, the reason you entered.
These entries record tenant, tenant group, price, and recommendation actions.
| Action | Entry shown |
|---|---|
| Add a tenant | Created - Tenant - {name} |
| Edit a tenant | Updated - Tenant - {name} |
| Move a tenant | Moved - Tenant - {name} |
| Delete a tenant | Deleted - Tenant - {name} |
| Start a sync manually | Started - Manual sync - {name} |
| Create a tenant group | Created - Group - {name} |
| Edit a tenant group | Updated - Group - {name} |
| Move a tenant group | Moved - Group - {name} |
| Delete a tenant group | Deleted - Group - {name} |
| Set a custom price | Updated - Custom price - {license} |
| Remove a custom price | Removed - Custom price - {license} |
| Ignore a recommendation | Ignored - Recommendation - {type} - {name} |
| Restore a recommendation | Restored - Recommendation - {type} - {name} |
| Save recommendation settings | Updated - Recommendation settings - {tenant} |
Automatic syncs are not logged. Only syncs that someone starts manually appear.
For a moved tenant or tenant group, the details show where it moved from and to. For a moved tenant group, they also show how many nested tenant groups and tenants moved with it. For a custom price, they show the license, the tenant, and the price per seat per month, or None when the price was removed. Setting or removing a price adds one entry for each tenant it applies to. When you delete a tenant group, only the tenant group gets an entry. The tenants deleted with it do not get entries of their own.
An ignored recommendation reads, for example, "Ignored - Recommendation - Inactive licensed account - Contoso user", and the Description you enter when you ignore it is kept with the entry. For saved recommendation settings, the details show the new Evaluation duration and the one it replaced.
Task entries read like "Approved - License removal - Jane Doe" or "Notification sent - Group member addition - Contoso Sales". They cover a request being raised, approved, or declined, a notification being sent, a task being marked as done or moved back to not done, and a request being replaced by a newer one. An entry names at most three people or groups, and then shows "+N more".
Alert entries read, for example, "Configured the 'License seat shortage' alert" or "Acknowledged the 'License seat shortage' incident raised at 26 Oct 2026 10:30 UTC", followed by the comment if you entered one. Entries for updating, switching on, and switching off an alert also show a Changes view with the previous state.
Automation entries read, for example, "Updated - Automation - Remove licenses from inactive accounts" or "Ran - Automation - Remove licenses from inactive accounts - 7 licenses removed".
Categories, filters, and export
On the module page, you filter by these categories.
| Category | What it records |
|---|---|
| Groups | Changes to tenant groups, such as creating, moving, or deleting one. |
| Tenant management | Changes to tenants, such as adding, editing, moving, or deleting one, manual syncs, custom prices in the Global price catalog, license renames and resets, and changes to a tenant's recommendation settings. |
| License assignment | Requests for license changes, such as a license removal, excluding a user from removals or including the user again, and ignoring or restoring a recommendation. |
| Approvals | Decisions on license tasks, notifications sent about them, tasks marked as done or moved back to not done, and requests replaced by a newer request. |
| Automation rules | Changes to license removal automations, and each run that removed licenses, failed, or was blocked. A run that did nothing is not logged. |
| Escalation policy management | Creating, updating, and deleting escalation policies. |
| Reports | Configuring, switching on or off, and generating reports. Scheduled report runs are not logged. |
| User management | Adding, editing, and removing users, and changing roles and permissions. |
| Alert configuration | Configuring and switching alerts on or off, and changing the status of their incidents. |
In the tenant group and tenant log, the Category filter lists the features instead: General, Tenants, Users, Groups, Licenses, Change tracking, Optimization, Tasks, Automation, Monitoring, and Reports. Alert changes are logged under Monitoring. Entries that do not belong to a feature, such as user management, show NA as the feature. Tenant actions show Tenants as the feature, and tenant group actions show Groups. License renames, resets, and custom price changes show Licenses, and exclusions show Users. Ignoring or restoring a recommendation and saving recommendation settings show Optimization, and task entries show Tasks.
You can also filter by date range and by user. The Source filter lets you choose User or Automation. Changes made by an automation show a robot icon and the automation's name, so you can tell them apart from changes made by a person.
Export logs downloads the entries in the current filtered view as an Excel file. The file has these columns: Activity type, Description, Performed by, Detail, Category type, Feature type, and Logged At. Detail holds the full details of the entry.
You cannot edit or delete entries. Some entries have no earlier state to compare, so their Changes view is not available.