Audit

Event categories

The audit log covers the following categories of events:

• User management: adding, updating, or removing users, groups, or service accounts, and changing group membership.

  When you change a user's group membership, the log records the change for that user. To view which group was affected, check the event metadata.

• Role assignments: assigning or unassigning a role for a user, group, or service account. When you change roles for several users, groups, or service accounts at once, the log records a separate event for each of them.

• AI access management: enabling or disabling AI access at the organization level, choosing whether it is granted to everyone in the organization or manually per user or group, and granting or revoking it per user, group, or service account. Logging works as follows:

  • When you change AI access for several users, groups, or service accounts at once, the log records a separate event for each principal whose access changed.

  • When you enable or disable AI access for the entire organization, or change how it is granted, the log records a single event. Both changes appear under the same action in the log table and in the action filter.

  • When you revoke AI access granted to a user individually, the log records the change even if the user still has access through a group.

  • When you grant access to a user who already has it through a group, nothing changes, and nothing is logged.

  • When you change a group's AI access, the log records a single event for that group. Access is recalculated for each group member, but those changes are not logged separately.

• AI credit limit management: updating the individual limit of a user or service account, and the organization's default AI credit limit.

Browse and filter the audit log

The audit log is presented as a table of events. Each event is described by the following columns:

• Timestamp: When the event occurred.

• Principal: Who performed the action. It can be a user, a service account, or a JetBrains Central Console internal service.

• Action: The type of action that was performed, shown as a technical identifier in the form domain.entity.verb (for example, ai.user-access.granted).

• Target: The entity that was affected by the action. The column shows the entity type and its name, for example, a user, a group, or the organization itself.

• Result: The outcome of the action. It can be one of the following:

  • Success: The action completed successfully.

  • Failure: The action did not complete because of an internal error.

  • Denied: The action was rejected because of insufficient permissions.

  • Pending: The action's outcome hasn't been recorded yet.

  • Blocked: The action was blocked by a policy rule.

The log table can be filtered by the following criteria:

• By the time the event occurred. Select a predefined time range or specify a custom date range. Use Today, 7 days, 30 days, or 90 days, or select a custom range in the date picker. In the table, you can only select a date range within the last 90 days.

• By the principal who performed the action. Type a name or user email and select one or more principals (users or service accounts), including those who have been removed from the organization, since their events remain in the log.

• By the action. Select one or more actions to include in the log. The list includes only the actions that have already occurred in your organization. Type part of an action identifier in the search field to narrow the list.

• By the target affected by the action. Search by name or user email and select groups, users, service accounts, or organizations. Other target types, such as projects, can appear in the Target column but cannot be selected in this filter. The table updates as you select targets and includes events for any selected target.

  Selecting a group includes only events that affected that group. Expand the group and select its subgroups separately to include events that affected them.

  Deleted groups cannot be selected in the Target filter, even though their events remain in the audit log.

  You can select up to 100 targets in total, counted across all target types. Each group counts as one target, even a large one, because selecting a group does not select its subgroups or its members. When you reach 100, unselected options are disabled, and you need to deselect a target to make room for another one.

The principal, action, and target filters are labeled All principals, All actions, and All targets until you select specific items. To clear a selection, click Reset in that filter's menu.

The date, principal, action, and target filters work together and the results show only events that match all the filters you set.

View and export the audit log