Export audit events
Download your tenant's audit events, under the tab, filters and date range you set, as one CSV file you can keep as evidence or hand to an auditor.
Who can do it
A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor working in your tenant. The same permissions that show the list allow the export, and the file holds only the trails you may read.
Before you start
- An export always covers a stated window. Set a Date range, or the export takes the window the list was actually served under. The window can span at most 365 days.
- Set the tab, filters and subject first: the file holds exactly the rows the list is built from.
Steps
- Open Audit Log from your tenant's navigation.
- Choose the tab, set the Date range and any filters or subject.
- Select Export CSV.
- In Export audit log, read What will be exported: the Window, the Active filters and the Format.
- Select Export CSV.
What you see when it worked
The console reports "Audit log exported" and your browser saves one CSV file. The file has the same fixed set of columns whichever tab you export from, and it does not include the details column.
An export stops at a row ceiling set for your installation, 10,000 rows by default. When it stops early the console warns: "The server stopped at its row ceiling — this file is not the whole result." Narrow the date range or the filters and export in parts.
If it fails
| What you see | Cause | What to do |
|---|---|---|
| Export CSV is disabled | The subject filter holds a value that cannot be one | Correct or clear the subject |
| "Choose a date range first: an export always covers a stated window." | No window is known for the list | Set a Date range and export again |
| "This environment's audit service cannot filter the export by subject ({subject}). No file was saved." | The audit service of this environment does not support the subject filter | Export without the subject, or ask your administrator |
| "The server stopped at its row ceiling — this file is not the whole result." | More rows match than the limit allows | Narrow the range or filters and export in parts |
| "Invalid date range for export query: maximum range is 365 days (received {n} days)" | The date range spans more than 365 days | Pick a range of 365 days or less and export in parts; see Invalid Input |
| The reason the audit service gave, or "The export failed" | The request was refused for another reason | Correct what the reason names and export again |
Without the console
| Surface | How |
|---|---|
| API | GET /api/v3/audit/tenants/{tenantId}/events/export (operation exportTenantEvents) with the same filters and subject as getUnifiedEvents. startTime and endTime are required and span at most 365 days, and a cursor is refused; a refused request answers 400 with the problem type invalid-input. The response carries X-Export-Row-Ceiling and X-Export-Applied-Filters before the first row, and X-Export-Rows and X-Export-Truncated after the last; an absent header means unknown, never complete |
There is no CLI command and no admin SDK method for the export.