User accounts audit log

View user activity across their accounts

As your organization's administrator, you can check critical actions carried out by users on their own accounts. These actions include changes to passwords, account recovery details (telephone numbers, email addresses), and 2-Step Verification enrollment.

Note: The User accounts audit log may not be displayed in the left-navigation menu if there are no records for the audit log during the previous 6 months.

Open the User accounts audit log

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in

  2. From the Admin console Home page, go to Reports.
  3. On the left, click Auditand thenUser Accounts.
  4. (Optional) To customize what data you see, on the right, click Manage columns "". Select the columns that you want to see or hideand thenclick Save.

Data you can view

The User accounts audit log provides the following information:

Data type Description
Event description

Summary of the event. For example

  • Account password changeUsername has changed Account password
  • Account recovery email changeUsername changed Account recovery email

Date and time the event occurred (browser default time zone)

IP address IP address associated with the logged action. The address can reflect the user’s physical location, a proxy server, or a Virtual Private Network (VPN) address.

Event names

At Add a filter, select an Event name to filter data for that event. The audit log shows entries for each time the particular event occurred during the time range that you set. Most event names are self-explanatory.

Event name Description
2-step verification disable Each time a user disables 2-Step Verification
2-step verification enroll Each time a user enrolls for 2-Step Verification
Account password change Each time a user changes an account password

Note: This refers to users changing passwords at It doesn’t include password changes when the admin forces users to change their password at the next sign in.

Account recovery email change Each time a user changes a recovery email address
Account recovery phone change Each time a user changes an account recovery phone number
Account recovery secret question/answer change Each time a user changes an account recovery secret question and answer.

When and how long is data available?

Go to Data retention and lag times.

Related topics

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Clear search
Close search
Google apps
Main menu
Search Help Center