---
title: Audit logging
category: procurement
order: 3
lastUpdated: 2026-06-08
featureAvailability: GA
roles: [admin, district-admin]
navigationPath: Administration → Audit log
relatedArticles: [procurement/security-overview, procurement/ferpa-overview, reporting/audit-reports]
---

## At a glance

- **Who uses it:** Admins responding to FERPA inquiries, security teams reviewing user activity, district leadership exporting evidence.
- **When to use it:** During access reviews, after a suspected incident, or as part of a periodic FERPA audit.
- **Permissions required:** School admin (own school) or district admin (all schools in district). Super admins have cross-org visibility but are filtered out of customer-facing lists.
- **Navigation path:** Administration → Audit log.

## Purpose

The audit log is the immutable record of who did what, where, and when across AmplifyED. It is the evidence base for FERPA compliance, incident investigation, and access reviews.

## What is logged

Every sensitive action, including:

- **Identity:** sign-in, sign-in failure, password reset, role change, user invite, user deactivate.
- **Records:** student record view, student record export, FERPA dossier generation, student merge.
- **Cases:** case created, status changed, follow-up set, note added, case message posted.
- **Administration:** branding update, intake form publish/unpublish, attention rule upsert, assignment rule upsert.
- **Imports:** every CSV import batch (teacher, student-assignment, staff).
- **Integrations:** LMS connect/disconnect, SSO domain verification.

## What is captured per event

- Timestamp (UTC, displayed in your org's time zone).
- Actor (user ID, name, email).
- Actor context (IP address, user agent).
- Action (canonical action name).
- Target entity (org, school, student, case, note).
- Structured JSON metadata (before/after where applicable).

[SCREENSHOT: admin-audit-log-list]
_Administration → Audit log with filters set to a specific user and the last 30 days; one expanded row shows the JSON metadata pane._

## Step-by-step

### Search the log

1. **Administration → Audit log**.
2. Filter by date range, actor, action type, or target entity.
3. Click a row to see the full metadata.

### Export

1. Apply your filter.
2. Click **Export CSV**. Up to 10,000 rows export per file. Narrow your filter if you exceed that.

## Retention

Audit log entries are retained for **7 years**, independent of the case retention setting. This is to support FERPA recordkeeping and to outlast typical incident-investigation timelines.

## Tips & best practices

- Run a quarterly review filtering on `role_change` and `user_invite` actions.
- Pair audit exports with your district's records-retention schedule so evidence is preserved in your own systems too.
- Use the actor filter when investigating a specific complaint.

## Related articles

- [Security overview](/help/procurement/security-overview)
- [FERPA overview](/help/procurement/ferpa-overview)
- [Audit reports](/help/reporting/audit-reports)

## FAQ

**Can audit entries be deleted?**
No — the log is append-only. Records that contain incidentally sensitive content can be redacted (body cleared, entry preserved) only by super-admin escalation.

**Are super-admin actions logged?**
Yes. Super-admin (AmplifyED platform staff) actions are recorded in the global audit log and visible to district admins on the audited org.