Audit logs and activity history
What is recorded
The admin portals record key actions so that changes can be traced if issues occur. This includes:
- Organisation‑level changes such as adding, updating or deleting organisations and email domains.
- Changes to public IP addresses and site configuration.
- Admin account changes such as new admins being invited, details updated, or accounts removed.
These logs help you understand what changed, when, and by whom, especially during incident investigation and routine housekeeping.
How to use logs
- During a potential major incident, review activity and change history around the time issues started, focusing on bulk or high‑impact changes such as domain removals or IP edits.
- As part of annual housekeeping, sample‑check change history and logs to confirm the portal is being used as expected.
- When cleaning up data (for example, removing old organisations or domains), record what you changed so that future investigations can reference it if needed.
If you spot unexpected or suspicious changes in the logs, follow your organisation’s security process and inform the GovWifi team.