Run the Learn365 audit trail report

Introduction

Many individual actions and events are undertaken to deliver training to learners.

The Audit trail feature supports the tracking of these activities and their ownership by recording key actions performed by learners and admins in Learn365, such as changes made to courses and course content, as well as learners' interactions with courses and training plans.

The information recorded provides documentary evidence of these actions to help in cases related to regulatory compliance, troubleshooting, or to gain further insights into learner records. Find more information about scenarios in which the Audit trail feature would prove useful in this article.

In this article, we provide information about how to use the Audit trail feature, export the information recorded in it, and get an overview of the downloaded report.

 

Audit Trail page

Required role: Microsoft 365 global admins or LMS admins.

The Audit trail option can be accessed from the Global Settings of Learn365.

The Audit Trail page enables you to directly view the derived logs and access detailed activity information, enabling access to audit data without being dependent on external applications.

 

 

The audit logs are displayed in reverse chronological order, with the newest events at the top of the list and the oldest events at the bottom. In the bottom right corner, the number of audit logs of the current date range is displayed.

Change the display order to newest to oldest by selecting the Date and time column heading.

The Activity column displays the event description.

In the Initiated by column, you can see who or what initiated the event:

• User name. You'll see a user name specified:
  • When a user triggered an event.
  • For promotional courses. This will be the name of the user who created the course catalog and as a result, triggered the course import.
  • For imported Go1/LinkedIn Learning training. This will be the name of the user who imported the training into the course catalog.

• Learn365 System. This refers to:
  • Events performed by Learn365 webjobs, for example the expiry of certificates, skills revoked from learners, and so on.
  • Events that are triggered by an update to the Microsoft Entra (Azure Active Directory) group, for example a learner is enrolled in or unenrolled from a course or training plan, registered for a session, or their session registration is canceled.

• API key. Displays the API key name the user used to initiate the event, for example API key: Full Access. If the API key doesn't have a name, the masked key will be displayed instead, for example: API key: ********-****-****-****-4fd39eb32b99.

Selecting the relevant audit log opens the Activity details panel, which displays the related information in JSON format:

• Date and exact time of the event.
• Course or training plan to which the event related.
• Event description.
• Catalog in which the event took place.
• The user, API key, or Learn365 System that initiated the event.
• Detailed information of the event, presented in JSON format.

 

 

Filtering options

Except for sorting the logs based on the Date and time column to view them from oldest to newest, you can use various filters to narrow down the logs you want to extract.

Filters can be based on:

• Date and exact time of the activity
• Activity type
• Course catalog
• Training name
• Who or what the event was initiated by:
  • User
  • API key
  • Learn365 System

To filter logs by date and time, select the date range option displayed above the audit logs list on the Audit Trail page. This opens a date range panel, where you can set the start and end dates and times for the audit log report.

 

 

• Start date and time. Set the start date and time for the audit log report. The earliest allowed start date is April 03, 2023. The time format inherits the time zone of the user's browser settings. By default, this field is populated with the date and time that is exactly 24 hours before you opened the Audit Trail page.
  
  
• End date and time. Set the end date and time for the audit log report. The time format inherits the time zone of the user's browser settings. By default, this field is populated with the date and time you opened the Audit Trail page.

Selecting any of the presets on the left-hand side enables you to extend the default date and time range according to the selected preset. However, manual adjustment of the dates in the calendar automatically enables the Custom preset, which enables you to set the date and time range yourself.

Select Apply to view audit logs that match the selected date and time range. Cancel will close the panel and revert the date and time range to the default settings.

You can see the number of audit logs that match the date and time range set in the bottom right corner.

If no audit logs match the applied dates and filters, then the "No records found for selected dates and filters." message is displayed on the Audit Trail page.

The downloaded report will contain all logged activities within the selected date and time range.

 

Additionally, you can use filters to narrow down the list of logs displayed on the Audit Trail page within the selected date and time range. Selecting Filters opens a panel that enables you to select filter parameters.

 

 

• Activity. Selecting this field provides a drop-down list of all available events, from which you can select the events that you want to display on the Audit Trail page. This field is optional and, if left empty, all logs will be displayed.
  
  
• Catalog. From the drop-down list, you can select the catalogs from which you want to display the events. This field is optional and, if left empty, logs from all catalogs will be displayed. Deleted catalogs are marked with the Deleted label.
  
  
• Course or training plan. Here, you can select the events of specific courses and training plans you want to display on the page. This field is optional and, if left empty, logs of all courses and training plans will be displayed. Deleted courses and training plans are marked with the Deleted label. Courses that were imported via the Import action on the Users page won't have any labels.
  
  
• Initiated by. Select the triggers of the activities you want to see:
  • User. Use this field to narrow the list to show only the events that were initiated by the specified users.
  • API key. From the drop-down list, select the relevant API keys to filter events.
  • Initiated by Learn365 system. Select the checkbox to filter events performed by Learn365 webjobs, such as the expiry of certificates, the import of course records, and so on.

The results of the Initiated by filter will show all activities that are initiated by either filter. This filter is optional and, if left empty, all logs initiated by users, API keys, and the Learn365 system will be displayed. 

 

 

Select Clear next to the relevant field to clear your selection or Clear all in the bottom right-hand corner of the panel to clear all the fields.

When ready, select Apply to update the list of logs on the Audit Trail page according to the selected filters and the set date and time range. Once selected, the Apply option will become disabled until the filters are changed. You can see the number of audit logs that match the filters in the bottom right corner.

 

To remove all of the applied filters, select the cross next to Filters in the top bar.

 

Export audit logs

Required role: Microsoft 365 global admins or LMS admins.

To export audit logs records, follow these steps:

1. In the Learn365 Admin Center, go to Global Settings and select Audit Trail. The Audit Trail page opens.

2. On the Audit Trail page, all logs from all catalogs within the default 24-hour date and time range are displayed.

The Export option runs on the audit log records that are currently displayed on the page. Adjusting the date and time range and applying filters enables you to narrow the export report to include only the required information. The downloaded JSON file will contain the audit log records for the specified activities for the selected courses and training plans of specific catalogs within the selected date and time range.

The time zone used for collecting the data will be UTC (Universal Time Coordinated).

3. Select Export to export the audit log report.

In the notification center, you'll see a link that will enable you to download the report. The link will be available for one hour after the report is generated.

Moreover, due to the built-in Microsoft Entra ID (Azure Active Directory) configurations, the folder to which the report is exported is automatically tidied every day, meaning reports generated the previous day will no longer be available.

 

 

4. Select the link in the notification center to download the audit log report in JSON file format. 

The file name will be "audit-trail-{startDateTime}-{endDateTime}", where {startDateTime} and {endDateTime} are replaced with the corresponding dates set in the fields.

 

Audit trail report

The downloaded JSON file will contain the audit log records for the specified date and time range and the applied filters. The time zone used for collecting the data will be UTC (Universal Time Coordinated).

The events in the report correspond to the relevant actions performed by learners and admins in Learn365. The events currently available in the Learn365 Audit Trail feature can be found in this article.