Logs, audit and retention

Frontdoor keeps two separate records: the access log (who opened which app) and the audit trail (who changed what). Both are for owners only.

Access logs

Frontdoor records an access every time a user opens an app, in every connection mode. Open Logs (/admin/logs) to review them.

• Search by user, app or IP address.
• Choose a Period from 1 to 90 days.
• Choose how many rows to show per page (50 to 250).
• Top apps shows the most opened apps in the period, with their click counts.
• The summary shows total accesses, unique users and apps accessed.

Audit trail

Open Audit (/admin/audit) to see privileged changes: role changes, user activation, group and app edits, branding updates, cache refreshes and backup operations.

Each row reads as a sentence: who did what to which item, by name. Changed fields appear as old → new. Saves that change nothing are not logged. Names of users, groups and apps are kept with each row, so it stays readable after they are deleted. You can copy or expand the raw JSON of each event.

• Filter by administrator to follow a single privileged account.
• Choose a Period, with the same pagination as the access log.
• Administrator sign-ins are hidden by default; choose All events to include them.
• Impersonation only shows the sessions in which an admin acted as a user, one session at a time. See Users and Entra sync.

Timestamps are stored in UTC and shown in your time zone. The audit trail uses the YYYY-MM-DD, HH:MM:SS format.

Set the retention

In Customize, Log retention defines how many days Frontdoor keeps both access logs and audit logs: from 0 to 90 days. The default is 90 days.

Frontdoor deletes older entries at startup and then once a day. The change does not delete records when you save it: cleanup runs at the next automatic cycle, so you can still roll back.

Logless mode

Set the retention to 0 (Logless) to stop keeping logs. At the next cleanup, Frontdoor removes both access logs and audit logs from the database.

Clear the access log now

In Customize, Access log cleanup offers Clear access log: it removes every row from the Logs page at once. Audit logs are not affected.