Logged activities in the Sitecore Cloud Portal

Note

To start forwarding audit logs to your external system, use the Webhook REST API to create a webhook.

Sitecore Cloud Portal activities always use the EUW region (https://mesh-management-api-euw.sitecorecloud.io).

The Sitecore Common Audit Log records when a team member has a role assigned or removed. This includes both organization roles and app roles, so you can also see when a team member joins or is removed from an organization.

It also records when a Sitecore support engineer logs in to your organization or app to help resolve a technical issue.

Here's a list of all the activities that Sitecore Common Audit Log records for Sitecore Cloud Portal entities:

Activity

Description

roles_assigned

Team member has one or more roles assigned, or a person joins the organization.

roles_removed

Team member has one or more roles removed, or a team member is removed from the organization.

user_login

Sitecore support engineer (who is not a member of the organization) logs in to your organization or app to help resolve a technical issue.

The following example shows the audit logs that are created when an organization admin, Jane, performs certain actions in a Sitecore Cloud Portal organization:

Detailed activity properties

The following table describes the fields of each activity in the Sitecore Cloud Portal:

Entity

Activity

Field descriptions

support_user

user_login

  • entity.id - email address of the support engineer.

  • extensions.clientId - ID of the app where the engineer logged in.

  • extensions.eventId - ID of the event.

  • extensions.reason - reason for logging in.

  • extensions.tenantId - ID of the tenant where the engineer logged in.

  • sourceSystemUserContext.id - email address of the support engineer.

  • time - when the event occurred.

user

  • roles_assigned

  • roles_removed

  • entity.id - email address of the user that had roles assigned or removed.

  • extensions.eventId - ID of the event.

  • extensions.roles - object containing the collection of assigned or removed roles.

  • extensions.roles.tenantId - ID of the tenant where the user had a role assigned or removed.

  • extensions.roles.role - the role assigned or removed.

  • extensions.roles.scope - when you assign or remove an app role, scope is the name of the product or capability.

    When you assign or remove an organization role, scope is Organization.

  • sourceSystemUserContext.id - the email address of the user that performed the activity. If the activity was not performed by a user (for example, when Sitecore performs user migration), the value is Automation.

  • time - when the event occurred.

Do you have some feedback for us?

If you have suggestions for improving this article,