Group Admin Audit Trail

Use Group Admin Audit Trail to investigate cross-location group activity from the All locations workspace.

Where to find it - Web: All locations -> Audit. Mobile: Not available.

TL;DR

• Audit opens the group-level audit stream for linked locations and group governance events.
• The default date range is 30 days. You can switch to 7 days or 90 days.
• Filters include Location, Domain, Risk, Object type, Actor, and Search audit log.
• Group owners and regional managers can use Export -> Export filtered CSV.
• Detail sheets show safe before and after values, metadata, affected locations, source links, and redaction notes where available.

Requirements

Group Admin Audit Trail requires the group admin console and group allowlist access. The page is web-only and loads inside the All locations group workspace.

Requirement	Details
Plan	The group admin surface is for linked PRO group workflows.
Workspace	Open from All locations -> Audit.
View access	Users must have access to the group workspace and linked locations shown in the stream.
Export access	Group owner or regional manager permission is required.
Platform	Web only. Mobile has no group audit screen.

If the page cannot load, OpenChair shows Audit trail unavailable with Retry and Back to All locations.

What appears in the audit stream

Group Admin Audit Trail combines group-level audit rows with safe projections from selected related systems. The page shows the note: Group rollout, policy, inbox governance, billing exports, and source-linked venue events appear when available.

Source	What appears
Canonical audit events	Group events and source-linked venue events that belong to accessible linked locations.
Group rollout runs	Applied group rollout runs, affected location counts, statuses, and safe rollout snapshots.
Inbox governance events	Group conversation oversight changes and source links back to the venue inbox when available.
Billing and export events	Export and billing-domain audit rows when the underlying event exists.
Policy events	Policy-domain audit rows and rollout activity when the policy surface records them.

The stream does not backfill events that were never written to the audit tables. It also hides rows for locations that are not accessible from the current group access.

Use the audit stream

The audit stream is the main investigation table. It is labelled Audit stream and uses the table label All locations audit events on desktop.

Desktop columns are:

Column	Meaning
Time	When the event occurred.
Risk	Low, Medium, or High risk.
Domain	The operational area, such as rollout, billing, campaign, inbox, or access.
Actor	The operator, system actor, customer, support user, or AI actor recorded for the event.
Location	The affected location, affected location count, or Group.
Event	Action, summary, partial reason, and Open details link.
Source	Open when a source link is available, or No source link.

Use Refresh to reload the stream. Use Load more when older rows are available for the current filters.

Filter group audit events

Filters narrow the audit stream before viewing details or exporting.

Filter	Options
Audit date range	7 days, 30 days, 90 days
Location	All locations or one linked location
Domain	All domains, Rollout, Policy (when shipped), Billing, Campaign, Inbox, Access
Risk	All risk levels, High, Medium, Low
Object type	Free text object type, such as group_rollout_run or conversation
Actor	Actor user ID
Search audit log	Search across actor, domain, action, object, location, summary, and partial reason text

Saved filters give quick access to common views:

Saved filter	What it sets
Recent rollout activity	Domain Rollout, date range 30 days.
Billing and export risk	Domain Billing, risk High, date range 90 days.
Inbox governance	Domain Inbox, risk Medium, date range 7 days.

Use Reset to return to the default filters.

Open event details

Open event details when you need the source, actor, affected location, and safe before and after values for a row.

1. Find the event in Audit stream.
2. Select Open details.
3. Review the risk badge and domain badge.
4. Check Actor, Time, Source, Object, Affected, and Source link.
5. Use Open source when a source link is available.
6. Review Affected locations, Before, After, Metadata, and Redaction notes.

When no values are safe to show, the detail sheet says No safe values stored. If the source cannot be opened, it says Source object is missing, archived, or unavailable from this group.

Export filtered CSV

Export filtered CSV creates a downloadable file from the current filters. Export is available only to group owners and regional managers.

To export:

1. Set the date range and filters you need.
2. Click Export.
3. Select Export filtered CSV.
4. Wait for Audit export created.

The export filename uses the group slug and date, such as group-slug-audit-2026-07-08.csv. CSV exports are capped at 500 rows and include:

CSV field	Meaning
Time	Event timestamp in ISO format.
Actor	Display name or fallback actor label.
Location	Location name, affected location count, or group.
Domain	Formatted audit domain.
Risk	Formatted risk level.
Action	Formatted action.
Object	Object type and object ID when present.
Summary	Event summary.
Source	Source system identifier.

OpenChair records a separate audit event when a group audit export is created. That audit event stores filter metadata only; it does not duplicate the CSV contents in the event detail.

Redaction and source links

Group audit details show safe snapshots rather than raw private payloads. Redaction notes explain when detail is intentionally limited.

Examples of current redaction behaviour include:

Event type	Redaction behaviour
Rollout detail	Shows stored safe snapshots only. Business settings are not reconstructed from mutable source state.
Inbox governance detail	Conversation body content remains in the source inbox and is not duplicated into group audit detail.
Audit export event	Stores filter metadata only. CSV contents are not duplicated in audit detail.

Source links can be unavailable when the source record is archived, missing, outside the current group access, or not exposed from this audit surface.

Risk levels

Risk levels help prioritise investigation work, but they do not decide whether an event is visible.

Risk	How OpenChair assigns it
High	Billing, access, delete, revoke, failed, or partially failed events.
Medium	Rollout, policy, inbox, or campaign events.
Low	Other included events.

Who can use this

Group audit access depends on group workspace access and export permissions.

Role	Access
Group owner	Can view the group audit stream and export filtered CSV.
Regional manager	Can view the group audit stream and export filtered CSV.
Permitted group operator	May view the group audit stream for accessible locations, but export is blocked.
Location-only team member	No group audit access unless they also have permitted group access.

When export is unavailable, the page shows Owner or regional manager only and the export button is disabled with Group owner or regional manager permission is required.

Common mistakes

Do not expect Audit to behave like Activity Feed. Audit rows are investigation records, not notifications or tasks.

Do not export before narrowing the filters. CSV export uses the current filters and is capped at 500 rows.

Do not assume No source link means the event is invalid. The source may be archived, missing, outside current group access, or intentionally unavailable.

Do not expect the group audit stream to show every historical event. It can show only records and projections available in the current audit sources.

Troubleshooting

Issue	Solution
Audit trail unavailable	Click Retry. If it still fails, return to All locations and confirm the group admin console is enabled for the group.
No audit events match these filters.	Use Reset, widen the date range to 90 days, or clear Location, Domain, Risk, Object type, Actor, and search filters.
Export is disabled	Export requires group owner or regional manager permission. Ask a group owner or regional manager to export the filtered CSV.
Source object is missing, archived, or unavailable from this group.	Use the row detail that is available, or open the source location directly if you have permission.
Source link says Unavailable	The affected location or source record is not accessible from the current group audit view.

FAQ

What is Group Admin Audit Trail?

Group Admin Audit Trail is the All locations audit stream for a linked group. It shows group governance events and selected source-linked venue events in one investigation view.

Who can export group audit events?

Group owners and regional managers can export filtered group audit events. Other permitted group users may be able to view the audit stream but cannot export it.

What is included in a group audit export?

The CSV export includes the filtered audit list fields: time, actor, location, domain, risk, action, object, summary, and source. It does not include raw detail payloads or duplicate CSV contents inside the export audit event.

Why does an audit row have no source link?

A row can have no source link when the source object is missing, archived, unavailable, outside the current group access, or not exposed from the group audit surface.

Related Articles

• Audit Log
• Group Policy Management
• Group Admin Rollouts
• Managing Multiple Venues