Security log
See who changed access to your workspace, and who took data out of it.
Overview
The security log is one place to answer the first question of an access review: what security-relevant changes happened in this workspace? It records:
| Category | What is recorded |
|---|---|
| Access | Users created, deleted, given or removed roles, suspended or reactivated; changes to what a custom role grants; and moving a phone’s push notifications to another account |
| Credentials | Service users created; API keys created, changed and revoked; passkeys added and removed, sign-in methods linked and removed, and password resets |
| Authentication | Every sign-in, and every wrong password for an existing account |
| Data | Workspace exports created and downloaded |
| Audit | Exports of the security log itself |
A failed sign-in shows Unknown user as the actor, since nobody has proven who tried. When someone’s own passkeys, sign-in methods or password change, mTime also emails them, so a person whose account someone else changed finds out.
Each entry says who did it (a person, a service user’s API key, your identity provider through SCIM, or a scheduled job), when, from which IP address and browser, and what changed — for example the roles before and after.
Entries are kept for 24 months and cannot be edited or deleted. They are not part of a workspace export: export the security log itself to keep your own copy.
Who can see it
Owners can see the security log. To let someone else run your access reviews, give their role the security-log: read permission in .
Reviewing the log
- Go to
- Pick the period to review, and optionally a category or an event
- Click an entry to see its details
- To follow one person, API key or role, open an entry’s menu and choose Show entries by this actor or Show entries about this subject
Click Load more at the bottom of the list to see older entries.
Exporting the log
Click Export to download every entry matching your filters as an Excel workbook. Keep it as evidence of your review. The export is itself recorded in the log.
Troubleshooting
| Issue | Solution |
|---|---|
| The menu item is missing | Your role doesn’t grant security-log: read . Ask an owner. |
| A name shows as “Unknown user” | The person was removed from mTime and their data was erased. The entry itself is kept. |