Audit

Event categories

The audit log covers the following categories of events:

• User management: adding, updating, or removing users, groups, or service accounts, and changing group membership.

  When you change a user's group membership, the log records the change for that user. To view which group was affected, check the event metadata.

• Role assignments: assigning or unassigning a role for a user, group, or service account. When you change roles for several users, groups, or service accounts at once, the log records a separate event for each of them.

• AI access management: enabling or disabling AI access at the organization level, choosing whether it is granted to everyone in the organization or manually per user or group, and granting or revoking it per user, group, or service account. Logging works as follows:

  • When you change AI access for several users, groups, or service accounts at once, the log records a separate event for each principal whose access changed.

  • When you enable or disable AI access for the entire organization, or change how it is granted, the log records a single event. Both changes appear under the same action in the log table and in the action filter.

  • When you revoke AI access granted to a user individually, the log records the change even if the user still has access through a group.

  • When you grant access to a user who already has it through a group, nothing changes, and nothing is logged.

  • When you change a group's AI access, the log records a single event for that group. Access is recalculated for each group member, but those changes are not logged separately.

• AI credit limit management: updating the individual limit of a user or service account, and the organization's default AI credit limit.

Browse and filter the audit log

The audit log is presented as a table of events. Each event is described by the following columns:

• Timestamp: When the event occurred.

• Principal: Who performed the action. It can be a user, a service account, or a JetBrains Central Console internal service.

• Action: The type of action that was performed, shown as a technical identifier in the form domain.entity.verb (for example, ai.user-access.granted).

• Target: The entity that was affected by the action. The column shows the entity type and its name, for example, a user, a group, or the organization itself.

• Result: The outcome of the action. It can be one of the following:

  • Success: The action completed successfully.

  • Failure: The action did not complete because of an internal error.

  • Denied: The action was rejected because of insufficient permissions.

  • Pending: The action's outcome hasn't been recorded yet.

  • Blocked: The action was blocked by a policy rule.

The log table can be filtered by the following criteria:

• By the time the event occurred. Select a predefined time range or specify a custom date range. In the table, you can only select a date range within the last 90 days.

• By the principal who performed the action. Type a name and select one or more principals (users or service accounts).

• By the action. Select one or more actions to include in the log. The list includes only the actions that have already occurred in your organization.

View and export the audit log