Review what the platform did on your tenant
See the changes the platform's operators made to your tenant (its status and closure, key backend, notification providers, observability, email domains, integration settings, administrative workloads, trusted issuers and federated identities), and every time they read your tenant's audit trail.
Who can do it
A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor working inside the tenant. Each section needs its own audit permission: the actions need a permission to read the administrative audit trail, the reads need the permission to read the audit-access log.
Before you start
- Nothing needs to be configured, on any deployment type.
- A platform read of the event feed, a platform timeline or a correlation lookup that included your records is listed too, with your own count. Not listed: platform statistics that do not name your tenant (a ranking can count your records without listing you when you are below its cut), records that belong to no tenant, rejected audit records and automated integrity checks.
Steps
- Open Platform Activity under Monitoring & audit.
- In Actions by the platform, use Show to narrow the list to one type of object, or Everything. Read each row: When, Action, Acted on and Outcome.
- In Reads of this tenant's audit trail, read each row: When, Operator, Records returned and Outcome.
What you see when it worked
Both lists show the newest first.
- An action reads Created, Changed or Deleted, with Succeeded, Failed or Denied, and the operator always reads Platform operator. A trusted issuer row shows its Issuer; a binding row shows the Issuer, the Subject and the Actor. A key-encryption key destruction row shows its Reason and, when a platform quorum approved it, the number of approvals, never who approved.
- A read names the operator by login on a deployment your organization operates. On a deployment ANKATech operates, or for a platform token that carries no tenant, it reads Platform operator with a Reference that ANKATech support can resolve. Refused reads are listed too.
If it fails
| What you see | Cause | What to do |
|---|---|---|
| "Your role does not include reading the platform's activity on this tenant. An administrator with access to the tenant's audit trail can see it." | You hold neither audit permission | Ask for the tenant auditor role |
| "Details not shown: the record does not match its signature." | The stored record was changed after it was signed | Treat it as a possible tampering; verify the audit trail's integrity and report it |
| "Details not shown: the record could not be checked against its signature." | The signature could not be checked | Try again later; if it persists, report it |
| "Unknown: the record does not match its signature" on a read | The stored read record was changed after it was signed | Treat it as a possible tampering and report it |
| "A value was shortened to 2048 characters." | A value is longer than the screen shows | Nothing is lost from the record; read it through the API if you need it |
Without the console
| Surface | How |
|---|---|
| API | GET /api/v3/audit/tenants/{tenantId}/admin/platform-actions (operation listPlatformActions), optional entityType, page and size |
| API | GET /api/v3/audit/meta/tenants/{tenantId}/platform-reads (operation listTenantPlatformReads), page and size |