Create evidence reports
An information security audit asks questions like these: Who can access what today? Who signs in without a second factor? When someone left, when was their access removed? Who changed rules or the sign-in policy? The administration app answers each of them with a report, as an Excel file you can filter and as a PDF you can hand over.
Solution overview
In the Protokoll (Log) area, Weitere (More) > Nachweisberichte (Evidence reports) offers four reports:
| Report | Contents | Scope |
|---|---|---|
| Rechteübersicht … (Rights overview …) | every person with status, second factor, Windows account, SQL login, rules, and number of valid keys; every rule with its entries; every key that isn't revoked; Windows accounts and SQL logins that hold rules | as of the time the report is created |
| MFA-Abdeckung … (MFA coverage …) | totals and names of active people by second-factor status (none, set up but not confirmed, active); the sign-in rules that require a code; valid keys marked Ohne zweiten Faktor (Without second factor) | as of the time the report is created |
| Austritte und Sperren … (Departures and locks …) | accounts disabled or enabled again, people deleted; revoked keys; ended sessions; removed rules and assignments—each with time and actor | a period, from the change log |
| Verwaltungsänderungen … (Administration changes …) | every change to rules, sign-in policy, data sources, identities, assignments, settings, and mail templates, and every command, with the values before and after | a period, from the change log |
Every report starts with a header: the report name, Erstellt (UTC) (Created, UTC), Erstellt von (Created by: the workstation's Windows account), Angemeldet mit (Signed in with), the address of the Datendienst (data service), Installation (the installation name from the settings), and the limits of the source. Reports for a period also show Zeitraum (UTC) (Period, UTC).
Steps
- Open the Protokoll area.
- Choose Weitere > Nachweisberichte, then the report.
- For Austritte und Sperren and Verwaltungsänderungen only: enter the first and last day of the period as
2026-07-21or21.07.2026. Both days are included, and days are in UTC. The last 90 days are suggested. - Choose the folder for the files.
Result: The folder contains two files with the same name, for example
Rechteübersicht 2026-10-19 1405Z.xlsx and ….pdf; Z stands for UTC. The Excel file has a
Bericht (Report) sheet with the header and one sheet per section. The PDF is in landscape and
shows the report name and page number on every page. A message names both files.
Notes
- No past reference date. The rights overview and MFA coverage show the state when you create them. To compare later, create them regularly and keep them. What changed between two states is shown in Austritte und Sperren and Verwaltungsänderungen.
- Reports for a period come from the change log. It holds every applied change with its actor and is kept without a limit. The request audit isn't a source, because it only goes back as far as the service keeps it (90 days by default, see Read the log and sessions).
- The change log isn't tamper-proof. Anyone who can write to the service's store file can change it, and the header of every period report says so. Protect the file on the server (see Administration store and master key (data service documentation)).
- What the reports don't contain. The app doesn't manage Windows group membership or the permissions inside the databases themselves, and whether a sign-in rule applies also depends on the network and the sign-in method. Child entries deleted together with their parent row don't appear separately in the change log.
- Long values. In Verwaltungsänderungen, the values before and after are cut off after 1,500 characters (the HTML of a mail template, for example). The Protokoll area shows them in full.
- Personal data. The reports contain names, accounts, and times. Store the files only where your logs belong, and delete them according to your retention policy (see Security and privacy).
- Excel doesn't need to be installed. The app writes both files itself.
Related topics
- Reference: HTTP: administration (reference), entity sets
ChangeLog,Persons,PersonalKeys(data service documentation)