---
schema_version: "1"
id: 514c925ca4033491a35e6813100021d93d8855bc747bc64ce5aa6b660b7f2ac0
title: Audit Permissions Using the Activity Log
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/online/activity_log_audit_permissions.md
canonical_url: https://help.tableau.com/current/online/en-gb/activity_log_audit_permissions.htm
source_site: help.tableau.com
content_type: documentation
content_hash: cfbcdce2b35b0ccf2eb375f41c3ca6a1d9e04dfdafbc862072d4d6928994c76f
description: Audit which users changed content permissions and access controls using Activity Log events.
---
[Skip to main content](#main-content)

# Audit Permissions Using the Activity Log

Permission auditing allows system administrators to monitor which users have modified access controls to Tableau content. There are two ways to modify access control: _explicit_ changes (by changing permission capabilities on a project or content item) and _effective_ changes (by changing user site roles, group membership, moving content and so on). All of these changes are recorded, so administrators can certify that security and access controls are maintained.

For more information about how permission rules are evaluated, see [Effective permissions](https://help.tableau.com/current/online/en-gb/permission_effective.htm).

## Log format

Every action that modifies user or group access to content will get a log entry. Each log entry is structured in a JSON format, with specific keys representing different pieces of information. A log entry contains two parts:

- Metadata: Contains information about when and where an action occurred and what user performed the action.
- Action: Contains information about what piece of content had its permissions changed, what capabilities were changed and to what values the capabilities were changed.

**Note:** Activity Log records changes made through the Permissions Dialog UI and REST API. For more information about API methods, see [Permissions Methods](https://help.tableau.com/current/api/rest_api/en-gb/REST/rest_api_ref_permissions.htm).

The Activity Log entries are not formatted, and the keys are not sorted in any particular order in the logs. When auditing permissions, you can combine Activity Log data with other data sources, such as [Admin Insights](https://help.tableau.com/current/online/en-gb/adminview_insights.htm), to link IDs to names and make the events easier to interpret.

### Example

The following is an example log entry showing a group was allowed to connect to a data source.

{  
	"actorUserId": 39872,  
	"actorUserLuid": "4e6b42bf-9040-4e60-b326-1c56a4fb96f8",  
	"authorizableType": "DATASOURCE",  
	"capabilityId": 32,  
	"capabilityValue": "connect",  
	"contentId": 2099835,  
	"contentName": "Superstore ExtractNeal3",  
	"eventTime": "2023-01-31T22:44:23.650058Z",  
	"granteeId": 22,  
	"granteeLuid": "dae0717a-d524-436d-b469-fadeaa22a5dd",  
	"granteeType": "Group",  
	"granteeValue": "GROUP\_ALLOW",  
	"initiatingUserId": 39872,  
	"initiatingUserLuid": "4e6b42bf-9040-4e60-b326-1c56a4fb96f8",  
	"isError": false,  
	"eventCategory": "security",  
	"eventType": "set\_permissions",  
	"eventVersion": "1.0",  
	"permissionType": "explicit",  
	"siteLuid": "b45e272d-10c7-49d5-9037-e53ce47dbf4e"  
}

The log entry captures essential information regarding the event, including:

- `eventType` shows a set-permissions event occurred
- `permissionType` shows an explicit change to permissions
- `contentId` shows the ID of the content that was modified
- `authorizableType` shows the content type, in this case, a data source
- `capabilityValue` shows the capability that was changed
- `granteeId` shows the grantee that was affected
- `actorUserId` shows the ID of the user who performed the change
- `eventTime` shows the date and time of the change

## Events

Log entries contain various event types for permissions changes, such as `content_owner_change` when the content owner changes or `set_permissions` when a permission rule is created or updated. Different actions produce different events. For more information about event types, attributes and when they’re recorded, see [Activity Log Site Event Type Reference](https://help.tableau.com/current/online/en-gb/activity_log_schema.htm).