Audit
Open Settings → Audit → Security for sign-in and identity events, or Runs & Activity → Identity for SSO, SCIM and identity-provider events only.
| Event | Recorded |
|---|---|
| Sign-in | Who, and for SSO the provider and protocol (SAML or OIDC) |
| Failed SSO sign-in | The provider, protocol and reason: not a member, no account, expired request, response rejected (signature, audience or certificate) |
| Account created on sign-in | The person, the provider, and whether it was a new account or an existing Waxell account added to this workspace |
| Identity provider added, changed or removed | Who, and what changed, old and new value per setting |
| Enforce SSO turned on or off | Who, and which provider |
| Require single sign-on for everyone turned on or off | Who |
| SCIM token generated | Who, and which provider |
| SCIM user created, deactivated or reactivated | The person, and the provider whose SCIM token made the call |
| Sign-in email sent | Who sent it to whom, or that SCIM sent it |
| MCP connector SSO started / completed | The email, workspace and gateway when a client like Claude is connected with SSO |
| Owner recovery link requested or used | Who |
| OAuth activity | Authorizations, tokens issued and refused, MCP client registrations, connected and revoked upstream accounts |
| Directory activity | Connections and syncs, people merged, addresses added or removed |
Every row records when, and from which IP address and user agent. Rows made by your identity provider over SCIM name the provider instead of a person.
Secrets never appear in the log. A changed client secret isn't recorded at all, and a new signing certificate is shown only as "changed". SCIM tokens aren't recorded either.